Description

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-13T18:18:19.103Z",
  "pubdate": "2026-08-13T18:18:19.103Z",
  "executiveSummary": "A denial of service vulnerability exists in @hono/node-server versions 2.0.0 through 2.0.10, specifically involving WebSocket upgrade request handling.\nThe vulnerability type is a resource management flaw leading to unbounded memory growth and service unavailability.\nThe affected product is @hono/node-server, specifically impacting the WebSocket upgrade routing mechanism.\nThe risk implications include potential complete service disruption through resource exhaustion of the underlying Node.js process.\nAn unauthenticated attacker can exploit this vulnerability by flooding public WebSocket upgrade routes with specially crafted requests containing missing or malformed Sec-WebSocket-Key headers.\nExploitation requires network access to a public route configured with an upgradeWebSocket handler, but requires no authentication or special privileges.",
  "technicalDetails": "The root cause of the vulnerability resides in src/websocket.ts within @hono/node-server versions 2.0.0 to 2.0.10.\nWhen a WebSocket upgrade request is processed for an upgradeWebSocket route, the server retains the request's IncomingMessage object within the waiterMap data structure while awaiting a connection event.\nIf the request contains a missing or malformed Sec-WebSocket-Key header, the underlying ws.handleUpgrade implementation fails to emit a connection event, leaving the associated waitForWebSocket promise permanently pending.\nBecause the aborted handshake lacks any cleanup path or timeout mechanism, the IncomingMessage instances accumulate indefinitely within the waiterMap.\nThe attack flow proceeds as an unauthenticated attacker sends a high volume of malformed WebSocket upgrade requests over the network to a publicly exposed route.\nEach request triggers the allocation of uncollectible objects, resulting in unbounded memory growth within the Node.js runtime environment.\nOver time, continuous exploitation exhausts available system memory, culminating in application crashes and denial of service for legitimate users.\nThe vulnerable component is explicitly the WebSocket upgrade handling logic in src/websocket.ts, affecting versions 2.0.0 up to, but not including, 2.0.10."
}