CVE-2026-126343

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the TCP connection during that window, the socket emits an unhandled ECONNRESET error and terminates the Node.js process. If a global uncaughtException handler suppresses termination, the pending upgrade waiter is not released and repeated requests can grow the heap. This affects applications that enable WebSocket support and perform asynchronous work on the upgrade path. This issue is fixed in version 2.1.6.

• CWE-248

• https://github.com/honojs/node-server/commit/61cc0267e613e684401f17c27538ba3bf97339a4
• https://github.com/honojs/node-server/releases/tag/v2.1.6
• https://github.com/honojs/node-server/security/advisories/GHSA-qv5m-9pm6-hqp3

Published

Nov 12, 2026

Last Modified

Nov 12, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126329Docker Sandboxes reuses existing state and configuration dir…7.3
• CVE-2026-12633The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c…8.1
• CVE-2026-126330Docker Sandboxes can silently republish a sandbox service af…2.4
• CVE-2026-126331Insertion of sensitive information into sent data in the use…
• CVE-2026-126332Improper access control in the autofill vault search in Devo…
• CVE-2026-12634The NVS backend of the Zephyr settings subsystem (subsys/set…5.3
• CVE-2026-126344@hono/node-server allows running the Hono application on Nod…5.4
• CVE-2026-126345basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the …5.3
• CVE-2026-126346basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPC…5.9
• CVE-2026-126347Tornado is a Python web framework and asynchronous networkin…3.1
• CVE-2026-126348Addressable is an alternative implementation to the URI impl…4.3
• CVE-2026-126349Addressable is an alternative implementation to the URI impl…3.1