CVE-2026-73565
MEDIUM
5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: low
Description
AI Translation Available
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.
401
Missing Release of Memory after Effective Lifetime
DraftCommon Consequences
Security Scopes Affected:
Availability
Other
Potential Impacts:
Dos: Crash, Exit, Or Restart
Dos: Instability
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Reduce Performance
Applicable Platforms
Languages:
Not Language-Specific, C, C++
770
Allocation of Resources Without Limits or Throttling
IncompleteCommon Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Dos: Resource Consumption (Other)
Applicable Platforms
All platforms may be affected
https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f7…
https://github.com/honojs/node-server/releases/tag/v2.0.10
https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg