CVE-2026-73565
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
@hono/node-server from version 2.0.0 to 2.0.10 has a vulnerability in WebSocket handling where an upgrade request with a missing or malformed Sec-WebSocket-Key header causes the request to remain in waiterMap with no cleanup path after the handshake is aborted. This allows an unauthenticated attacker to flood a public route, causing unbounded memory growth and service unavailability.
Risk Assessment
Risk of DoS attacks on services using WebSocket, leading to memory exhaustion and service disruption.
Recommendation
Upgrade @hono/node-server to version 2.0.10 or later.
Original NVD description (English source)
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.