CVE-2026-126343

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126343", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-11-10T21:12:01.226Z", "datePublished": "2026-11-12T21:27:05.380Z", "dateUpdated": "2026-11-12T21:27:05.380Z"}, "containers": {"cna": {"title": "@hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process", "problemTypes": [{"descriptions": [{"cweId": "CWE-248", "lang": "en", "description": "CWE-248: Uncaught Exception", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/honojs/node-server/security/advisories/GHSA-qv5m-9pm6-hqp3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/honojs/node-server/security/advisories/GHSA-qv5m-9pm6-hqp3"}, {"name": "https://github.com/honojs/node-server/commit/61cc0267e613e684401f17c27538ba3bf97339a4", "tags": ["x_refsource_MISC"], "url": "https://github.com/honojs/node-server/commit/61cc0267e613e684401f17c27538ba3bf97339a4"}, {"name": "https://github.com/honojs/node-server/releases/tag/v2.1.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/honojs/node-server/releases/tag/v2.1.6"}], "affected": [{"vendor": "honojs", "product": "node-server", "versions": [{"version": ">= 2.0.0, < 2.1.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-12T21:27:05.380Z"}, "descriptions": [{"lang": "en", "value": "@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the TCP connection during that window, the socket emits an unhandled ECONNRESET error and terminates the Node.js process. If a global uncaughtException handler suppresses termination, the pending upgrade waiter is not released and repeated requests can grow the heap. This affects applications that enable WebSocket support and perform asynchronous work on the upgrade path. This issue is fixed in version 2.1.6."}], "source": {"advisory": "GHSA-qv5m-9pm6-hqp3", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "node-server", "vendor": "honojs", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.1.6"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the TCP connection during that window, the socket emits an unhandled ECONNRESET error and terminates the Node.js process. If a global uncaughtException handler suppresses termination, the pending upgrade waiter is not released and repeated requests can grow the heap. This affects applications that enable WebSocket support and perform asynchronous work on the upgrade path. This issue is fixed in version 2.1.6."}], "id": "CVE-2026-126343", "lastModified": "2026-11-12T22:19:19.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-11-12T22:19:19.140", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/honojs/node-server/commit/61cc0267e613e684401f17c27538ba3bf97339a4"}, {"source": "security-advisories@github.com", "url": "https://github.com/honojs/node-server/releases/tag/v2.1.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/honojs/node-server/security/advisories/GHSA-qv5m-9pm6-hqp3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-248"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.1.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "node-server", "source": "cna", "vendor": "honojs"}, "product": "node-server", "vendor": "hono"}], "created": "2026-11-13T01:30:09.227678+00:00", "updated": "2026-11-13T01:30:09.227700+00:00", "vendors": ["hono", "hono$PRODUCT$node-server"]}