# CVE-2026-73565

## Summary

- **CVE ID:** CVE-2026-73565
- **Severity:** MEDIUM
- **CVSS Score:** 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
- **CWE:** CWE-401, CWE-770
- **Published:** Aug 13, 2026
- **Last Modified:** Aug 14, 2026

## Description

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10.

## Affected Products

- honojs — node-server (>= 2.0.0, < 2.0.10)

## References

- [CNA](https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg)
- [CNA](https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1)
- [CNA](https://github.com/honojs/node-server/releases/tag/v2.0.10)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.39%
- **EPSS Percentile:** 32.2

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._