GHSA-9mqv-5hh9-4cgg

Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

Published

2026-07-21

Modified

2026-07-21

Sources

github-advisory

Summary

## Summary A WebSocket upgrade request to an `upgradeWebSocket` route with a missing or malformed `Sec-WebSocket-Key` header leaks memory permanently. The request's `IncomingMessage` is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the route is reachable pre-handshake without authentication, an unauthenticated attacker can flood it to gradually exhaust memory. ## Details The built-in WebSocket helper cleans up its internal map only on a successful handshake or when the route guard rejects the request. When `ws` aborts the handshake because `Sec-WebSocket-Key` is missing or malformed, no `connection` event is emitted, so neither cleanup path runs and the entry is retained forever. A present-but-malformed key leaks identically, so a proxy that only checks for the header's presence does not mitigate it. ## Impact An unauthenticated attacker can flood any public `upgradeWebSocket` route with malformed-key upgrade requests, causing unbounded memory growth and eventual loss of availability. No confidentiality or integrity impact. Reported by @TarPeg007.

Affected packages

Remediation: Upgrade to 2.0.10 or later.

References

• https://github.com/advisories/GHSA-9mqv-5hh9-4cgg