Is CVE-2026-73565 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73565 being exploited in the wild.

How severe is CVE-2026-73565?

Medium severity, with a CVSS score of 5.3, published 13 August 2026.

Which products and versions are affected?

@hono/node-server (npm) SEMVER:introduced=2.0.0,fixed=2.0.10.

Is there a fix for CVE-2026-73565?

Yes. @hono/node-server (npm): upgrade to 2.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73565 attacked?

It is attacked over the network.

Am I affected by CVE-2026-73565?

Check whether you run @hono/node-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73565: Hono Node.js Adapter WebSocket memory leak DoS

CVE-2026-73565 · Severity: medium · CVSS 5.3 · Published 2026-08-13

The Hono Node.js Adapter is a web server framework that includes built-in WebSocket support. An unauthenticated attacker can send specially crafted WebSocket upgrade requests to publicly accessible routes, causing the server to leak memory indefinitely. By flooding the application with these requests, an attacker can exhaust available memory and crash the service, causing a denial of service.

Technologies: @hono/node-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-73565 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73565 being exploited in the wild.
How severe is CVE-2026-73565?: Medium severity, with a CVSS score of 5.3, published 13 August 2026.
Which products and versions are affected?: @hono/node-server (npm) SEMVER:introduced=2.0.0,fixed=2.0.10.
Is there a fix for CVE-2026-73565?: Yes. @hono/node-server (npm): upgrade to 2.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73565 attacked?: It is attacked over the network.
Am I affected by CVE-2026-73565?: Check whether you run @hono/node-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@hono/node-server (npm): upgrade to 2.0.10 or later
```
npm install @hono/node-server@2.0.10
```

Technical details

The vulnerability is a memory leak (CWE-401) and resource exhaustion (CWE-770) issue in the WebSocket upgrade handler. When a WebSocket upgrade request arrives with a missing or malformed Sec-WebSocket-Key header, the ws library aborts the handshake without emitting a connection event. The vulnerable code retains the request's IncomingMessage in an internal map and leaves a pending promise unsettled, because cleanup only occurs on successful handshake or when route guards reject the request. Since WebSocket upgrade routes are reachable before authentication, an unauthenticated attacker can repeatedly send malformed upgrade requests over the network (attack vector: network, no privileges or user interaction required) to gradually exhaust memory. A proxy checking only for header presence does not mitigate the issue, as malformed values leak identically. The patch in version 2.0.10 adds a reject callback to properly settle promises on handshake failure.

Affected products

Hono @hono/node-server >=2.0.0, <=2.0.9

Identifiers

CVE-2026-73565
GHSA-9mqv-5hh9-4cgg

Timeline

2026-07-21: disclosed
2026-07-21: patched: Fixed in version 2.0.10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.