CVE-2026-73565 in node-server
Summary
by MITRE • 08/13/2026
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability resides in the hono/node-server implementation where WebSocket upgrade requests are processed through the upgradeWebSocket route functionality. When a client sends a WebSocket handshake request with either a missing Sec-WebSocket-Key header or a malformed header value, the system fails to properly handle this abnormal condition. The core flaw occurs in the src/websocket.ts file where the IncomingMessage object from the request is stored in a waiterMap data structure without proper cleanup procedures. This retention creates a memory leak scenario because the waitForWebSocket promise remains indefinitely pending, preventing garbage collection of the associated request objects.
The technical implementation issue stems from how the WebSocket upgrade handler processes incoming connections through ws.handleUpgrade function which does not emit a connection event when encountering malformed headers. This absence of event emission means the system cannot trigger the necessary cleanup routines that would normally remove entries from the waiterMap and resolve the pending waitForWebSocket promise. The vulnerability represents a classic resource exhaustion attack vector where an attacker can continuously send malformed WebSocket upgrade requests to consume memory resources without proper termination paths.
This flaw directly impacts service availability by creating unbounded memory growth as each failed WebSocket handshake request accumulates in the waiterMap structure. The operational impact extends beyond simple memory consumption since the system becomes increasingly vulnerable to denial of service conditions as the memory footprint grows indefinitely. An unauthenticated attacker can exploit this weakness by flooding a public endpoint with malformed WebSocket upgrade requests, causing progressive degradation of service performance and potentially complete service unavailability.
The vulnerability aligns with CWE-400, which addresses improper handling of resource exhaustion conditions in software systems. From an adversarial perspective, this issue maps to ATT&CK technique T1499.004 related to Network Denial of Service through resource consumption attacks. The attack pattern follows a typical reconnaissance and exploitation sequence where the attacker identifies the vulnerable endpoint and systematically consumes resources until service disruption occurs. Mitigation strategies should include implementing proper request validation for WebSocket headers, establishing timeouts for pending upgrade requests, and ensuring automatic cleanup of abandoned connection attempts.
The fix implemented in version 2.0.10 addresses the root cause by adding proper error handling for malformed Sec-WebSocket-Key headers and ensuring that all WebSocket upgrade request paths include appropriate cleanup mechanisms. This update establishes proper lifecycle management for WebSocket upgrade requests, preventing accumulation of abandoned connections in memory structures while maintaining legitimate WebSocket functionality for compliant clients. The resolution follows security best practices for resource management and demonstrates the importance of defensive programming in network service implementations where malformed input can lead to critical system vulnerabilities.
The broader implications of this vulnerability highlight the need for comprehensive input validation and proper resource lifecycle management in modern web applications. Applications handling WebSocket connections must account for various malformed request scenarios and implement robust error recovery mechanisms to prevent resource exhaustion attacks. This case study emphasizes that seemingly minor implementation details in network protocols can create significant security weaknesses when proper cleanup and validation procedures are not implemented, particularly in high-availability services where resource consumption directly impacts system reliability and availability.