# CVE-2026-126343: @hono/node-server WebSocket ECONNRESET denial of service

Source: https://junglewise.ai/threats/cve-2026-126343-hono-node-server-unhandled-econnreset-on-the-socket-during-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126343 · Severity: medium · CVSS 5.3 · Published 2026-11-12

@hono/node-server is a runtime for running Hono web applications on Node.js. When WebSocket upgrade is enabled and async middleware is in use, an unauthenticated attacker can reset a TCP connection during the upgrade handshake to trigger an unhandled error that crashes the Node.js process. If the process does not crash, repeated attacks cause memory to leak and grow unbounded, leading to eventual resource exhaustion.

Technologies: [Hono @Hono/Node-Server](https://junglewise.ai/threats/technologies/node-server), [@hono/node-server (npm)](https://junglewise.ai/threats/technologies/hono-node-server). Vendors: [Hono](https://junglewise.ai/threats/vendors/hono), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-126343 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126343 being exploited in the wild.

**How severe is CVE-2026-126343?** Medium severity, with a CVSS score of 5.3, published 12 November 2026.

**Which products and versions are affected?** Hono @Hono/Node-Server 2.0.0 to 2.1.5; Hono Node-Server >= 2.0.0, < 2.1.6; @hono/node-server (npm) >= 2.0.0, < 2.1.6, SEMVER:introduced=2.0.0,fixed=2.1.6.

**Is there a fix for CVE-2026-126343?** Yes. @hono/node-server (npm): upgrade to 2.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126343 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126343?** Check whether you run Hono @Hono/Node-Server, Hono Node-Server or @hono/node-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @hono/node-server (npm): upgrade to 2.1.6 or later

  ```sh
  npm install @hono/node-server@2.1.6
  ```


## Technical details

The WebSocket upgrade handler in versions 2.0.0 through 2.1.6 does not attach error listeners to the socket before awaiting asynchronous middleware or application code. When a client resets the connection (TCP RST) during this window, an unhandled ECONNRESET error is emitted, crashing the process. If an uncaughtException handler suppresses the crash, the pending upgrade waiter leaks and is never released, causing heap growth on repeated attacks. The fix adds error and close event handlers to release the pending upgrade state.

## Affected products

- Hono @hono/node-server 2.0.0 to 2.1.5

## Identifiers

- CVE-2026-126343
- GHSA-qv5m-9pm6-hqp3

## Timeline

- 2026-11-12: disclosed

## References

- [https://github.com/honojs/node-server/commit/61cc0267e613e684401f17c27538ba3bf97339a4](https://github.com/honojs/node-server/commit/61cc0267e613e684401f17c27538ba3bf97339a4)
- [https://github.com/honojs/node-server/releases/tag/v2.1.6](https://github.com/honojs/node-server/releases/tag/v2.1.6)

## Related threats

- [@hono/node-server WebSocket upgrade host spoofing bypass](https://junglewise.ai/threats/cve-2026-126344-hono-node-server-allows-running-the-hono-application-on-node-js)
- [@hono/node-server path traversal via backslash bypass](https://junglewise.ai/threats/cve-2026-126210-hono-node-server-backslash-in-the-request-path-is-parsed-as-a)
- [@hono/node-server serveStatic path decoding bypass](https://junglewise.ai/threats/cve-2026-118663-hono-node-server-allows-running-the-hono-application-on-node-js)
- [Hono Node.js Adapter WebSocket memory leak DoS](https://junglewise.ai/threats/cve-2026-73565-hono-node-js-adapter-websocket-memory-leak-dos)
- [Hono Node.js Adapter path traversal in serve-static on Windows](https://junglewise.ai/threats/hono-node-js-adapter-path-traversal-in-serve-static-on-windows-4c8754f6)