TI-2026-51655 Aliases CVE-2026-73565 GHSA-9mqv-5hh9-4cgg

@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake

LOW 31CWE-401Published 2026-08-13 · Updated 2026-08-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-401.

Summary

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00529 44th percentileScored 2026-11-07

Fix Fixed node-server (honojs): 2.0.10@hono/node-server (npm): 2.0.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
honojs	node-server	2.0.0 to before 2.0.10	2.0.10	Patch available	CNA
—	@hono/node-server (npm)	2.0.0 to before 2.0.10	2.0.10	Patch available	GHSA-9mqv-5hh9-4cgg

node-server Vendorhonojs Affected 2.0.0 to before 2.0.10 Fixed in 2.0.10 Patch available CNA
@hono/node-server (npm) Vendor— Affected 2.0.0 to before 2.0.10 Fixed in 2.0.10 Patch available GHSA-9mqv-5hh9-4cgg

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:hono:node-server::::::::	—	—	honojs

cpe:2.3:a:hono:node-server:*:*:*:*:*:*:*:* Versions — — ·honojs

Remediation

Fix · CNA node-server (honojs) Fixed in 2.0.10
Fix · GHSA-9mqv-5hh9-4cgg @hono/node-server (npm) Fixed in 2.0.10 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 5 products

Migration Toolkit for Applications 8
Red Hat Ansible Automation Platform 2
Red Hat Developer Hub 1
Red Hat Hardened Images
Red Hat OpenShift Dev Spaces

Timeline

2026-10-02 Threatist record created from CVE-2026-73565
2026-10-03 Alias added: GHSA-9mqv-5hh9-4cgg
2026-10-27 Affected versions changed · Red Hat

References

Other 4

TI-2024-21741 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno CVSS 3.1MEDIUM 5.3
TI-2024-15441 @hono/node-server can't handle "double dots" in URL CVSS 3.1MEDIUM 5.3
TI-2024-32610 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. CVSS 3.1MEDIUM 5.9
TI-2024-29381 Hono CSRF middleware can be bypassed using crafted Content-Type header CVSS 3.1MEDIUM 5.0
TI-2026-39189 Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest CVSS 3.1MEDIUM 4.8
TI-2026-23190 Hono: Arbitrary file access via serveStatic vulnerability CVSS 3.1CRITICAL 9.8

See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences