CVE-2026-126343

Received Received - Intake

WebSocket ECONNRESET DoS in @hono/node-server

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: GitHub, Inc.

Description

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the TCP connection during that window, the socket emits an unhandled ECONNRESET error and terminates the Node.js process. If a global uncaughtException handler suppresses termination, the pending upgrade waiter is not released and repeated requests can grow the heap. This affects applications that enable WebSocket support and perform asynchronous work on the upgrade path. This issue is fixed in version 2.1.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-12

Last Modified

2026-11-12

Generated

2026-11-13

AI Q&A

2026-11-13

EPSS Evaluated

N/A

NVD

CVE-2026-126343

EUVD

EUVD-2026-124721

Affected Vendors & Products

Vendor	Product	Version / Range
hono	node-server	From 2.0.0 (inc) to 2.1.6 (inc)
hono	node-server	2.1.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

The vulnerability in @hono/node-server versions 2.0.0 to 2.1.6 affects WebSocket connections. When a client resets the TCP connection during asynchronous middleware processing, an unhandled ECONNRESET error crashes the Node.js process. If a global error handler prevents termination, repeated requests can leak memory by keeping the upgrade handler active.

Detection Guidance

This vulnerability can be detected by checking if your application uses @hono/node-server versions between 2.0.0 and 2.1.6 and has WebSocket support enabled. Review logs for ECONNRESET errors or Node.js process crashes during WebSocket upgrades.

Impact Analysis

This flaw can cause unexpected application crashes or memory exhaustion. Attackers could exploit it to disrupt services by forcing repeated connection resets. Systems with global error handlers are more vulnerable to memory leaks from pending upgrade requests.

Mitigation Strategies

Upgrade @hono/node-server to version 2.1.6 or later. If immediate upgrade is not possible, disable WebSocket support in the application or implement a global uncaughtException handler to prevent process termination.

Hi! I’m here to help you understand CVE-2026-126343. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...