CVE-2026-126343

Name of the Vulnerable Software and Affected Versions @hono/node-server versions 2.0.0 through 2.1.5

Description The WebSocket upgrade handler fails to attach an error listener to the socket before waiting for the Hono application to complete asynchronous middleware or handler tasks. An unauthenticated client can trigger an unhandled ECONNRESET error by resetting the TCP connection during this period, which leads to the termination of the Node.js process. In environments where a global uncaughtException handler prevents termination, the pending upgrade waiter remains active, and repeated requests can lead to heap memory growth. This issue impacts applications that enable WebSocket support and execute asynchronous operations during the upgrade path.

Recommendations Update @hono/node-server to version 2.1.6.