Hono Node Server EUVD-2026-58180

The vulnerable code path is reached only when all of the following are true: (1) the application uses @hono/node-server version 2.0.0-2.0.9; (2) at least one route is defined with the upgradeWebSocket helper; and (3) that route is reachable without prior authentication middleware rejecting the request. The trigger is an HTTP upgrade request with a missing or malformed Sec-WebSocket-Key header - the malformed variant bypasses proxy-level presence checks. Exploitation is limited by the need to sustain a request flood to achieve meaningful memory pressure; a single request leaks only one entry and one Promise, so isolated requests cause negligible impact. Services that place authentication middleware before the WebSocket route, or that deploy rate-limiting at an upstream proxy performing WebSocket header validation, significantly raise the bar for exploitation.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L scores 5.3 (Medium), reflecting that exploitation is trivially accessible from the network with no authentication and no complexity, but the availability impact is rated Low rather than High - consistent with the attack requiring sustained flooding to exhaust memory rather than causing immediate service failure. No EPSS data was provided in the input. KEV status is absent (not in CISA KEV at time of analysis), and no independent POC exploit code has been published beyond the GHSA advisory and associated test case. The combination of PR:N and AV:N means any instance exposing a WebSocket route publicly is reachable by anyone on the internet, making the effective attack surface broad for affected deployments. However, the absence of active exploitation, the low-to-medium severity rating, and the requirement to sustain a request flood to achieve impact keeps real-world urgency moderate. The A:L rating may understate risk for resource-constrained environments where a modest sustained flood could trigger OOM faster than anticipated.

An attacker targeting a Node.js service using @hono/node-server 2.0.0-2.0.9 with a public WebSocket endpoint repeatedly sends HTTP upgrade requests containing a syntactically invalid Sec-WebSocket-Key value (e.g., a string that does not base64-decode to 16 bytes). Each request causes the server to retain an IncomingMessage object and a pending Promise in memory with no cleanup; at sufficient request rates, heap memory grows unboundedly until the Node.js process is killed by the OS OOM killer or crashes, denying service to all clients. No authentication is required and no prior reconnaissance beyond identifying the WebSocket route path is needed.