CVE-2026-73565

About vulnerability

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request’s IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.

Affected product:

AngularJS , Node.js , accounts , ag-ui , agents , ai-sdk-devtools , angular-create , angular-pwa , browserbasehq-stagehand , cloudflare-codemode , composio-anthropic , copilotkit , copilotkit-a2ui-renderer , copilotkit-agentcore-runner , copilotkit-mcp-apps-renderer , copilotkit-react-native , copilotkit-react-textarea , copilotkit-react-ui , copilotkit-runtime , copilotkit-runtime-client-gql , copilotkit-shared , copilotkit-sqlite-runner , copilotkit-voice , copilotkit-vue , copilotkit-web-components , copilotkit-web-inspector , create-factory , create-strapi , create-strapi-app , create-video , ext-apps , fumapress , honojs/middleware , js-genai , lynx-js-docs-mcp-server , mastra , mastra-client-js , mastra-cloudflare , mastra-cloudflare-d1 , mastra-code-sdk , mastra-connect , mastra-core , mastra-deployer , mastra-deployer-netlify , mastra-deployer-sandbox , mastra-deployer-vercel , mastra-docker , mastra-dsql , mastra-factory , mastra-fastembed , mastra-hono , mastra-mcp , mastra-mcp-docs-server , mastra-observability , mastra-playground-ui , mastra-react , mastra-server-adapters-test-suite , mastra-slack , mastra-tanstack-start , mastra-tavily , mastra-temporal , mastracode , modelcontextprotocol-client , modelcontextprotocol-ext-apps , modern-js-plugin-polyfill , modern-js-tsconfig , modern.js , prisma , remotion , remotion-animated-emoji , remotion-animation-utils , remotion-babel-loader , remotion-browser-bundler , remotion-bundler , remotion-captions , remotion-cli , remotion-cloudrun , remotion-codemods , remotion-compositor-darwin-arm64 , remotion-compositor-darwin-x64 , remotion-compositor-linux-arm64-gnu , remotion-compositor-linux-arm64-musl , remotion-compositor-linux-x64-gnu , remotion-compositor-linux-x64-musl , remotion-compositor-win32-x64-msvc , remotion-design , remotion-effects , remotion-elevenlabs , remotion-enable-scss , remotion-eslint-config , remotion-eslint-config-flat , remotion-eslint-plugin , remotion-fonts , remotion-gif , remotion-google-fonts , remotion-gsap , remotion-install-whisper-cpp , remotion-lambda , remotion-lambda-client , remotion-layout-utils , remotion-licensing , remotion-light-leaks , remotion-lottie , remotion-mac-cursors , remotion-maptiler , remotion-mcp , remotion-media , remotion-media-parser , remotion-media-utils , remotion-motion-blur , remotion-noise , remotion-openai-whisper , remotion-paths , remotion-player , remotion-preload , remotion-promo-pages , remotion-renderer , remotion-rive , remotion-rough-notation , remotion-rounded-text-box , remotion-sdk , remotion-serverless , remotion-serverless-client , remotion-sfx , remotion-shapes , remotion-skia , remotion-starburst , remotion-streaming , remotion-studio , remotion-studio-protocol , remotion-studio-server , remotion-studio-shared , remotion-svg-3d-engine , remotion-tailwind , remotion-tailwind-v4 , remotion-three , remotion-timeline-utils , remotion-transitions , remotion-vercel , remotion-video-matting , remotion-web-renderer , remotion-webcodecs , remotion-whisper-web , remotion-whisper-webgpu , remotion-zod-types , remotion-zod-types-v3 , scalar , scalar-nextjs-api-reference , scalar-void-server , strapi , strapi-admin , strapi-cloud-cli , strapi-content-manager , strapi-content-releases , strapi-content-type-builder , strapi-core , strapi-data-transfer , strapi-database , strapi-email , strapi-generators , strapi-i18n , strapi-logger , strapi-openapi , strapi-permissions , strapi-plugin-cloud , strapi-plugin-color-picker , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-provider-email-mailgun , strapi-provider-email-sendgrid , strapi-provider-upload-aws-s3 , strapi-provider-upload-cloudinary , strapi-provider-upload-local , strapi-review-workflows , strapi-strapi , strapi-types , strapi-typescript-utils , strapi-upgrade , strapi-upload , strapi-utils , typescript-sdk , waku , wata

Affected packages:

@hono/node-server @ 1.19.11 (+2713 more)