{"id":"CVE-2026-73565","aliases":["EUVD-2026-58180","GHSA-9mqv-5hh9-4cgg"],"status":"published","title":"@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake","description":"@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00529,"percentile":0.45099,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401","CWE-770"],"published":"2026-07-21T22:04:27Z","modified":"2026-10-28T02:30:20Z","fixes":[{"ecosystem":"npm","package":"@hono/node-server","fixed_in":["2.0.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@hono/node-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"last_affected":"2.0.9"},{"fixed":"2.0.10"}]}]},{"source":"osv","ecosystem":"npm","package":"@hono/node-server","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.10"}]}]}],"products":[{"vendor":"honojs","product":"node-server"}],"references":[{"url":"https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/honojs/node-server/releases/tag/v2.0.10","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-9mqv-5hh9-4cgg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73565.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73565","tags":["advisory"]},{"url":"https://github.com/honojs/node-server","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-73565","title":"@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake","description":"@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.","status":"published","published":"2026-08-13T17:37:28.579Z","modified":"2026-08-14T16:45:25.711Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-401","CWE-770"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-58180","description":"@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.","status":"published","published":"2026-08-13T17:37:28Z","modified":"2026-08-14T16:45:25Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:01:54.570698Z"}],"ghsa":[{"id":"GHSA-9mqv-5hh9-4cgg","title":"Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake","description":"## Summary\n\nA WebSocket upgrade request to an `upgradeWebSocket` route with a missing or malformed `Sec-WebSocket-Key` header leaks memory permanently. The request's `IncomingMessage` is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the route is reachable pre-handshake without authentication, an unauthenticated attacker can flood it to gradually exhaust memory.\n\n## Details\n\nThe built-in WebSocket helper cleans up its internal map only on a successful handshake or when the route guard rejects the request. When `ws` aborts the handshake because `Sec-WebSocket-Key` is missing or malformed, no `connection` event is emitted, so neither cleanup path runs and the entry is retained forever. A present-but-malformed key leaks identically, so a proxy that only checks for the header's presence does not mitigate it.\n\n## Impact\n\nAn unauthenticated attacker can flood any public `upgradeWebSocket` route with malformed-key upgrade requests, causing unbounded memory growth and eventual loss of availability. No confidentiality or integrity impact.\n\nReported by @TarPeg007.","status":"published","published":"2026-07-21T22:04:27Z","modified":"2026-08-13T17:37:35Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-401","CWE-770"],"updated_at":"2026-11-02T14:41:00.097339Z"}],"nvd":[{"id":"CVE-2026-73565","description":"@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.","status":"published","published":"2026-08-13T18:18:19.103Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-401","CWE-770"],"updated_at":"2026-11-02T14:12:37.557758Z"}],"osv":[{"id":"CVE-2026-73565","title":"@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake","description":"@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.","status":"published","published":"2026-08-13T17:37:28.579Z","modified":"2026-10-28T02:30:20.906712111Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-401","CWE-770"],"updated_at":"2026-11-02T15:45:16.365946Z"},{"id":"GHSA-9mqv-5hh9-4cgg","title":"Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake","description":"## Summary\n\nA WebSocket upgrade request to an `upgradeWebSocket` route with a missing or malformed `Sec-WebSocket-Key` header leaks memory permanently. The request's `IncomingMessage` is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the route is reachable pre-handshake without authentication, an unauthenticated attacker can flood it to gradually exhaust memory.\n\n## Details\n\nThe built-in WebSocket helper cleans up its internal map only on a successful handshake or when the route guard rejects the request. When `ws` aborts the handshake because `Sec-WebSocket-Key` is missing or malformed, no `connection` event is emitted, so neither cleanup path runs and the entry is retained forever. A present-but-malformed key leaks identically, so a proxy that only checks for the header's presence does not mitigate it.\n\n## Impact\n\nAn unauthenticated attacker can flood any public `upgradeWebSocket` route with malformed-key upgrade requests, causing unbounded memory growth and eventual loss of availability. No confidentiality or integrity impact.\n\nReported by @TarPeg007.","status":"published","published":"2026-07-21T22:04:27Z","modified":"2026-08-13T17:55:56.703914Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-401","CWE-770"],"updated_at":"2026-11-02T15:46:43.875515Z"}]}}