CVE-2026-126343: @hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the TCP connection during that window, the socket emits an unhandled ECONNRESET error and terminates the Node.js process. If a global uncaughtException handler suppresses termination, the pending upgrade waiter is not released and repeated requests can grow the heap. This affects applications that enable WebSocket support and perform asynchronous work on the upgrade path. This issue is fixed in version 2.1.6.
Other sources
Summary
While @hono/node-server waits for the Hono application to handle a WebSocket upgrade request, the socket has no error listener. If the client resets the TCP connection during that time, the resulting ECONNRESET is emitted as an unhandled 'error' event and the process terminates.
Details
The upgrade handler awaits the application before attaching any listener to the socket. When middleware on the upgrade path does asynchronous work, such as an authentication lookup, a connection reset in that window has no handler. If a global uncaughtException handler swallows the error, the pending upgrade is never released and its entry is retained for the lifetime of the process.
The fix attaches error and close listeners to the socket before calling the application, releases the pending upgrade when the socket closes, and skips the handshake on a destroyed socket.
Impact
An unauthenticated client can terminate the server process with a single connection by sending a WebSocket upgrade request and resetting the connection before the application has responded. Where the crash is suppressed, repeated requests grow the heap.
This affects applications that enable WebSocket support in @hono/node-server and run asynchronous middleware or handlers on the upgrade path.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@hono/node-serverto a version that resolves this vulnerability.Fixed in 2.1.6 - Upgrade
Upgrade
@hono/node-serverto a version that resolves this vulnerability.Fixed in 2.1.6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using @hono/node-server versions from 2.0.0 through 2.1.5 are affected when they enable WebSocket support and perform asynchronous middleware or handler work during the WebSocket upgrade path. Deployments without those conditions are not described as affected.
What does an attacker need to do to trigger the failure?
An unauthenticated client only needs network access to initiate a WebSocket upgrade and reset the TCP connection while asynchronous upgrade-path work is still pending. No privileges or user interaction are required.
What is the impact if the process does not terminate on an uncaught exception?
If a global uncaughtException handler suppresses process termination, the pending upgrade waiter is not released. Repeated reset requests can then grow heap usage.
What version resolves the issue?
The issue is fixed in @hono/node-server version 2.1.6.