CVE-2026-73565

Name of the Vulnerable Software and Affected Versions @hono/node-server versions 2.0.0 through 2.0.9

Description A flaw exists when handling WebSocket upgrade requests to an upgradeWebSocket route. If the Sec-WebSocket-Key header is missing or malformed, the src/websocket.ts file retains the request's IncomingMessage in the waiterMap and leaves waitForWebSocket pending because ws.handleUpgrade does not emit a connection event. This lack of a cleanup path for aborted handshakes allows an unauthenticated attacker to flood a public route, leading to unbounded memory growth and potential service unavailability.

Recommendations Update to version 2.0.10.