Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-126343 EUVD-2026-124721GHSA-qv5m-9pm6-hqp3

@hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process

Published Nov 12, 2026 · Updated Nov 13, 2026 · Assigned by GitHub_M

Description

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the TCP connection during that window, the socket emits an unhandled ECONNRESET error and terminates the Node.js process. If a global uncaughtException handler suppresses termination, the pending upgrade waiter is not released and repeated requests can grow the heap. This affects applications that enable WebSocket support and perform asynchronous work on the upgrade path. This issue is fixed in version 2.1.6.

Affected products

VendorProductAffectedFixed
honojs node-server >= 2.0.0, < 2.1.6 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm @hono/node-server >= 2.0.0, < 2.1.6 2.1.6 GHSA-qv5m-9pm6-hqp3

References