CVE-2026-73565

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73565", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-12T20:53:46.381Z", "datePublished": "2026-08-13T17:37:28.579Z", "dateUpdated": "2026-08-14T16:45:25.711Z"}, "containers": {"cna": {"title": "@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake", "problemTypes": [{"descriptions": [{"cweId": "CWE-401", "lang": "en", "description": "CWE-401: Missing Release of Memory after Effective Lifetime", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg"}, {"name": "https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1", "tags": ["x_refsource_MISC"], "url": "https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1"}, {"name": "https://github.com/honojs/node-server/releases/tag/v2.0.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/honojs/node-server/releases/tag/v2.0.10"}], "affected": [{"vendor": "honojs", "product": "node-server", "versions": [{"version": ">= 2.0.0, < 2.0.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-13T17:37:28.579Z"}, "descriptions": [{"lang": "en", "value": "@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10."}], "source": {"advisory": "GHSA-9mqv-5hh9-4cgg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-14T16:45:01.113756Z", "id": "CVE-2026-73565", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T16:45:25.711Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73565", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-14T16:45:01.113756Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T16:45:20.429Z"}}], "cna": {"title": "@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake", "source": {"advisory": "GHSA-9mqv-5hh9-4cgg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "honojs", "product": "node-server", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.0.10"}]}], "references": [{"url": "https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg", "name": "https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1", "name": "https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/honojs/node-server/releases/tag/v2.0.10", "name": "https://github.com/honojs/node-server/releases/tag/v2.0.10", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "CWE-401: Missing Release of Memory after Effective Lifetime"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-13T17:37:28.579Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73565", "state": "PUBLISHED", "dateUpdated": "2026-08-14T16:45:25.711Z", "dateReserved": "2026-08-12T20:53:46.381Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-13T17:37:28.579Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "node-server", "vendor": "honojs", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.0.10"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10."}, {"lang": "es", "value": "@hono/node-server permite ejecutar la aplicaci\u00f3n Hono en Node.js. Desde la 2.0.0 hasta la 2.0.10, una solicitud de actualizaci\u00f3n de WebSocket a una ruta upgradeWebSocket con un encabezado Sec-WebSocket-Key faltante o malformado hace que src/websocket.ts retenga el IncomingMessage de la solicitud en waiterMap y deje waitForWebSocket pendiente porque ws.handleUpgrade no emite ning\u00fan evento de conexi\u00f3n. El handshake abortado, por lo tanto, no tiene una ruta de limpieza, lo que permite a un atacante no autenticado inundar una ruta p\u00fablica, causar un crecimiento de memoria ilimitado y, finalmente, dejar el servicio no disponible. Este problema est\u00e1 solucionado en la versi\u00f3n 2.0.10."}], "id": "CVE-2026-73565", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73565", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-14T16:45:01.113756Z", "version": "2.0.3"}}]}, "published": "2026-08-13T18:18:19.103", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1"}, {"source": "security-advisories@github.com", "url": "https://github.com/honojs/node-server/releases/tag/v2.0.10"}, {"source": "security-advisories@github.com", "url": "https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}, {"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "@hono/node-server: @hono/node-server: Denial of Service via aborted WebSocket handshake", "id": "2515517", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515517"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-459", "details": ["A flaw was found in @hono/node-server. An unauthenticated attacker can exploit this vulnerability by sending a WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header. This action causes the server to retain request data, leading to unbounded memory growth and eventually a Denial of Service (DoS), making the service unavailable."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict network access to the affected Grafana instance to trusted clients only. This can be achieved by configuring firewall rules to limit incoming connections to the port Grafana listens on. If the service is reloaded or restarted, ensure firewall rules persist."}, "name": "CVE-2026-73565", "package_state": [{"cpe": "cpe:/a:redhat:migration_toolkit_applications:8", "fix_state": "Not affected", "package_name": "mta/mta-solution-server-rhel9", "product_name": "Migration Toolkit for Applications 8"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "ansible-automation-platform-27/mcp-server-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "ansible-automation-platform-tech-preview/mcp-server-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Not affected", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Not affected", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-08-13T17:37:28Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-73565\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73565\nhttps://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1\nhttps://github.com/honojs/node-server/releases/tag/v2.0.10\nhttps://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg"], "statement": "The vulnerability in `@hono/node-server` is rated Moderate. An unauthenticated attacker can trigger a denial of service by sending malformed WebSocket upgrade requests, leading to unbounded memory growth.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.0.10)"}}], "enrichment": {"confidence": 94.0, "confidence_source": "matching", "scores": [{"score": 94.0, "source": "matching"}]}, "original": {"product": "node-server", "source": "cna", "vendor": "honojs"}, "product": "node-server", "vendor": "hono"}], "created": "2026-08-13T18:45:04.404796+00:00", "updated": "2026-08-18T04:45:04.416345+00:00", "vendors": ["hono", "hono$PRODUCT$node-server"]}