CVE-2026-73565
Received Received - Intake

WebSocket Memory Leak in Hono Node Server

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73565
EUVD
EUVD-2026-58180

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hono node_server From 2.0.0 (inc) to 2.0.10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73565 is an unauthenticated memory-leak denial-of-service (DoS) vulnerability in the @hono/node-server npm package. It occurs when a WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header is sent to an upgradeWebSocket route. The server fails to clean up the request's IncomingMessage and leaves a promise pending, causing permanent memory leaks. Attackers can exploit this by repeatedly sending malformed requests to exhaust server memory and crash the service.

Detection Guidance

To detect this vulnerability, monitor for unusual memory growth in your Node.js process hosting the Hono server. Check for repeated WebSocket upgrade requests with missing or malformed Sec-WebSocket-Key headers in your server logs. Use tools like `netstat` or `ss` to observe persistent connections that never complete handshakes.

Impact Analysis

This vulnerability allows unauthenticated attackers to flood a public route with malformed WebSocket requests, causing unbounded memory growth. This can lead to severe performance degradation, crashes, or complete service unavailability due to resource exhaustion. Systems with high traffic or limited memory are particularly vulnerable.

Mitigation Strategies

Upgrade the @hono/node-server package to version 2.0.10 or later immediately. If upgrading is not possible, disable WebSocket routes or implement rate limiting on the affected routes to prevent memory exhaustion attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73565. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart