Hono node-server memory leak DoS in WebSocket handshake

Executive brief

A vulnerability in the Hono Node.js adapter, which is used to build web servers, allows an attacker to crash the server by exhausting its memory. By sending specially crafted connection requests that are missing required security information, an attacker can force the server to permanently hold onto memory that it should have released. This can lead to a total service outage, preventing legitimate users from accessing the application.

Technical details

A memory leak exists in the @hono/node-server adapter's WebSocket implementation (CWE-401, CWE-770). The built-in WebSocket helper fails to settle pending promises or clean up its internal map when a handshake is aborted due to a missing or malformed 'Sec-WebSocket-Key' header. Because the 'connection' event is never emitted by the underlying 'ws' library in these cases, the cleanup logic is bypassed, causing the 'IncomingMessage' object to be retained indefinitely. An unauthenticated remote attacker can exploit this by flooding any public 'upgradeWebSocket' route with malformed upgrade requests, leading to a Denial of Service (DoS) via memory exhaustion. The issue is fixed in version 2.0.10.

Affected products

• Hono @hono/node-server >= 2.0.0, <= 2.0.9

Timeline

• 2026-07-15: patched: Version 2.0.10 released
• 2026-07-21: advisory: GitHub Advisory published

References

• https://api.github.com/users/TarPeg007
• https://github.com/TarPeg007
• https://api.github.com/users/TarPeg007/gists%7B/gist_id%7D
• https://api.github.com/users/TarPeg007/repos
• https://avatars.githubusercontent.com/u/172214852?v=4
• https://api.github.com/users/TarPeg007/events%7B/privacy%7D