Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake
Summary
A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the route is reachable pre-handshake without authentication, an unauthenticated attacker can flood it to gradually exhaust memory.
Details
The built-in WebSocket helper cleans up its internal map only on a successful handshake or when the route guard rejects the request. When ws aborts the handshake because Sec-WebSocket-Key is missing or malformed, no connection event is emitted, so neither cleanup path runs and the entry is retained forever. A present-but-malformed key leaks identically, so a proxy that only checks for the header's presence does not mitigate it.
Impact
An unauthenticated attacker can flood any public upgradeWebSocket route with malformed-key upgrade requests, causing unbounded memory growth and eventual loss of availability. No confidentiality or integrity impact.
Reported by @TarPeg007.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @hono/node-server | >= 2.0.0, < 2.0.10 | 2.0.10 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L- Weakness (CWE)
CWE-401, CWE-770- Platform
- npm
- Package
@hono/node-server- Disclosed
- 21.07.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-9mqv-5hh9-4cgg - CC BY 4.0
Vulnerability history: @hono/node-server
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 01.2024 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 4
Disclosures per year
- 2024: 2
- 2025: 0
- 2026: 4
-
Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.