CVE-2026-126343

MEDIUM 5.3

@hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the TCP connection during that window, the socket emits an unhandled ECONNRESET error and terminates the Node.js process. If a global uncaughtException handler suppresses termination, the pending upgrade waiter is not released and repeated requests can grow the heap. This affects applications that enable WebSocket support and perform asynchronous work on the upgrade path. This issue is fixed in version 2.1.6.

CWE	CWE-248
Vendor	honojs
Product	node-server
Published	Nov 12, 2026

Stay Ahead of the Next One

Get instant alerts for honojs node-server

Be the first to know when new medium vulnerabilities affecting honojs node-server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

honojs / node-server

>= 2.0.0, < 2.1.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/honojs/node-server/security/advisories/GHSA-qv5m-9pm6-hqp3 github.com: https://github.com/honojs/node-server/commit/61cc0267e613e684401f17c27538ba3bf97339a4 github.com: https://github.com/honojs/node-server/releases/tag/v2.1.6