Executive brief
The Hono Node.js Adapter is a web server framework that includes built-in WebSocket support. An unauthenticated attacker can send specially crafted WebSocket upgrade requests to publicly accessible routes, causing the server to leak memory indefinitely. By flooding the application with these requests, an attacker can exhaust available memory and crash the service, causing a denial of service.
Technical details
The vulnerability is a memory leak (CWE-401) and resource exhaustion (CWE-770) issue in the WebSocket upgrade handler. When a WebSocket upgrade request arrives with a missing or malformed Sec-WebSocket-Key header, the ws library aborts the handshake without emitting a connection event. The vulnerable code retains the request's IncomingMessage in an internal map and leaves a pending promise unsettled, because cleanup only occurs on successful handshake or when route guards reject the request. Since WebSocket upgrade routes are reachable before authentication, an unauthenticated attacker can repeatedly send malformed upgrade requests over the network (attack vector: network, no privileges or user interaction required) to gradually exhaust memory. A proxy checking only for header presence does not mitigate the issue, as malformed values leak identically. The patch in version 2.0.10 adds a reject callback to properly settle promises on handshake failure.
Affected products
- Hono @hono/node-server >=2.0.0, <=2.0.9
Timeline
- 2026-07-21: disclosed
- 2026-07-21: patched: Fixed in version 2.0.10