@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable.
This issue is fixed in version 2.0.10.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 3
https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f7…
security-advisories@github.com
https://github.com/honojs/node-server/releases/tag/v2.0.10
security-advisories@github.com
https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg
security-advisories@github.com