GHSA-9MQV-5HH9-4CGG: Unauthenticated Memory-Leak Denial of Service in @hono/node-server WebSocket Handshake Parser
Vulnerability ID: GHSA-9MQV-5HH9-4CGG
CVSS Score: 7.5
Published: 2026-07-21
An unauthenticated memory-leak Denial of Service (DoS) vulnerability exists in the Node.js Adapter for Hono (@hono/node-server) during the WebSocket handshake upgrade process. If a client initiates a WebSocket upgrade but the process is aborted or fails, resources are permanently retained in memory, leading to heap exhaustion.
TL;DR
Unauthenticated memory leak in @hono/node-server allows remote attackers to cause process termination via aborted WebSocket handshakes.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-400, CWE-401, CWE-772
- Attack Vector: Network (AV:N)
- CVSS v3.1: 7.5 (High)
- Exploit Status: Proof of Concept available
- Impact: Denial of Service (DoS) via Heap Exhaustion
- Fixed Version: >= 2.0.10
Affected Systems
- @hono/node-server
Mitigation Strategies
- Upgrade @hono/node-server to v2.0.10 or higher
- Implement reverse proxy filtering for invalid WebSocket handshakes
- Configure request rate limiting and strict timeouts
Remediation Steps:
- Verify current version of @hono/node-server in package.json
- Run npm install @hono/node-server@2.0.10 to update the package
- Deploy updated code to production and monitor memory usage
- Configure Nginx or Cloudflare to reject invalid Sec-WebSocket-Key headers
References
Read the full report for GHSA-9MQV-5HH9-4CGG on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)