github.com
https://github.com/honojs/node-server CVE-2026-73565
MEDIUM
@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake
Record summary
CVE-2026-73565 has a selected CVSS score of 5.3 (medium).
Description
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.
Description source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
node-serverBrowse honojs / node-server | CVE List | >= 2.0.0, < 2.0.10 | affected |
@hono/node-serverBrowse npm / @hono/node-server | GitHub Advisory | 2.0.0 to < 2.0.10 · Fixed in 2.0.10 | affected |
References
4github.com
https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1 github.com
https://github.com/honojs/node-server/releases/tag/v2.0.10 github.comConfirmation
https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg