CVE-2026-73565 honojs CVE debrief

Who should care

Defenders responsible for Node.js applications using @hono/node-server, particularly those exposed to public routes, should assess exposure and prioritize upgrading to version 2.0.10 or later

Why it matters

CVE-2026-73565 allows an unauthenticated attacker to cause unbounded memory growth in @hono/node-server versions 2.0.0 through 2.0.10 via WebSocket upgrade requests. Defenders should prioritize verifying exposure and upgrading to version 2.0.10 or later to prevent potential DoS attacks and service unavailability.

• Potential denial-of-service (DoS) via flood of public routes
• Unbounded memory growth leading to service unavailability
• Need for verification of exposure and upgrade to fixed version

Technical summary

A vulnerability in @hono/node-server versions 2.0.0 through 2.0.10 allows an unauthenticated attacker to cause unbounded memory growth via WebSocket upgrade requests with missing or malformed Sec-WebSocket-Key headers. The issue arises from the improper handling of such requests, leading to a denial-of-service (DoS) vulnerability. Defenders should prioritize verifying exposure and upgrading to version 2.0.11 or later to prevent potential attacks and service unavailability. The vulnerability is fixed in version 2.0.11.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to version 2.0.10 or later

Recommended defensive actions

• Verify if @hono/node-server versions 2.0.0 through 2.0.10 are in use and upgrade to version 2.0.11 or later
• Review WebSocket upgrade request handling and ensure proper cleanup of aborted handshakes
• Monitor for potential denial-of-service (DoS) attacks via flood of public routes
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from official CVE and NVD records, as well as source references from GitHub, indicates a vulnerability in @hono/node-server versions 2.0.0 through 2.0.10. The issue is caused by the improper handling of WebSocket upgrade requests with missing or malformed Sec-WebSocket-Key headers, leading to unbounded memory growth. Defenders should verify exposure and upgrade to version 2.0.11 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.