CVE-2026-73565: falha de média gravidade em honojs node-server
@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.5%
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
honojs · node-serverCVEs relacionadas — honojs node-server
No mesmo produto, das mais perigosas para as menos.
CVE-2024-32652HIGH@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsedEPSS 0.9%CVE-2024-23340MEDIUM@hono/node-server can't handle "double dots" in URLEPSS 0.7%CVE-2026-39406MEDIUM@hono/node-server has a middleware bypass via repeated slashes in serveStaticEPSS 0.4%CVE-2026-29087HIGH@hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static MiddlewareEPSS 0.4%CVE-2026-118663MEDIUM@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathsEPSS 0.4%