WebSocket Protocol Vulnerability in Hono Node.js Server by Hono
CVE-2026-73565

5.3MEDIUM

Key Information:

Vendor

Honojs

Status
Node-server
Vendor
CVE Published:
13 August 2026

What is CVE-2026-73565?

A vulnerability exists in the Hono Node.js Server where a malformed or missing Sec-WebSocket-Key header in a WebSocket upgrade request can lead to unbounded memory growth. Specifically, from versions 2.0.0 to 2.0.10, this flaw enables an unauthorized attacker to flood a public route, causing the service to become unavailable due to retained requests in the waiterMap without a cleanup path. This issue has been resolved in version 2.0.10.

Affected Version(s)

node-server >= 2.0.0, < 2.0.10

References

https://github.com/honojs/node-server/security/advisories...
x_refsource_CONFIRM
https://github.com/honojs/node-server/commit/3a21938c4183...
x_refsource_MISC
https://github.com/honojs/node-server/releases/tag/v2.0.10
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.