GHSA-9MQV-5HH9-4CGG: Unauthenticated Memory-Leak Denial of Service in @hono/node-server WebSocket Handshake Parser

Vulnerability ID: GHSA-9MQV-5HH9-4CGG
CVSS Score: 7.5
Published: 2026-07-21

An unauthenticated memory-leak Denial of Service (DoS) vulnerability exists in the Node.js Adapter for Hono (@hono/node-server) during the WebSocket handshake upgrade process. If a client initiates a WebSocket upgrade but the process is aborted or fails, resources are permanently retained in memory, leading to heap exhaustion.

TL;DR

Unauthenticated memory leak in @hono/node-server allows remote attackers to cause process termination via aborted WebSocket handshakes.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-400, CWE-401, CWE-772
• Attack Vector: Network (AV:N)
• CVSS v3.1: 7.5 (High)
• Exploit Status: Proof of Concept available
• Impact: Denial of Service (DoS) via Heap Exhaustion
• Fixed Version: >= 2.0.10

Affected Systems

• @hono/node-server

Mitigation Strategies

• Upgrade @hono/node-server to v2.0.10 or higher
• Implement reverse proxy filtering for invalid WebSocket handshakes
• Configure request rate limiting and strict timeouts

Remediation Steps:

1. Verify current version of @hono/node-server in package.json
2. Run npm install @hono/[email protected] to update the package
3. Deploy updated code to production and monitor memory usage
4. Configure Nginx or Cloudflare to reject invalid Sec-WebSocket-Key headers

References

• GHSA-9mqv-5hh9-4cgg Security Advisory
• Release v2.0.10

Read the full report for GHSA-9MQV-5HH9-4CGG on our website for more details including interactive diagrams and full exploit analysis.