CVE-2026-73565: @hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@hono/node-serverto a version that resolves this vulnerability.Fixed in 2.0.10
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73565?
The severity of CVE-2026-73565 is classified as medium with a score of 5.3.
How do I fix CVE-2026-73565?
To fix CVE-2026-73565, upgrade @hono/node-server to version 2.0.10 or later.
What type of vulnerability is CVE-2026-73565?
CVE-2026-73565 is an unauthenticated memory-leak Denial of Service (DoS) vulnerability.
Which versions of @hono/node-server are affected by CVE-2026-73565?
Versions 2.0.0 to 2.0.10 of @hono/node-server are affected by CVE-2026-73565.
What causes the vulnerability in CVE-2026-73565?
The vulnerability in CVE-2026-73565 is caused by a malformed or missing Sec-WebSocket-Key header in WebSocket upgrade requests.