No access to your tenant or devices. Every item links to its source. What this means
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the TCP connection during that window, the socket emits an unhandled ECONNRESET error and terminates the Node.js process. If a global uncaughtException handler suppresses termination, the pending upgrade waiter is not released and repeated requests can grow the heap. This affects applications that enable WebSocket support and perform asynchronous work on the upgrade path. This issue is fixed in version 2.1.6.
Read the publisher's advisory@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the TCP connection during that window, the socket emits an unhandled ECONNRESET error and terminates the Node.js process. If a global uncaughtException handler suppresses termination, the pending upgrade waiter is not released and repeated requests can grow the heap. This affects applications that enable WebSocket support and perform asynchronous work on the upgrade path. This issue is fixed in version 2.1.6.
Read the publisher's advisory@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the TCP connection during that window, the socket emits an unhandled ECONNRESET error and terminates the Node.js process. If a global uncaughtException handler suppresses termination, the pending upgrade waiter is not released and repeated requests can grow the heap. This affects applications that enable WebSocket support and perform asynchronous work on the upgrade path. This issue is fixed in version 2.1.6.
Read the publisher's advisory### Summary While `@hono/node-server` waits for the Hono application to handle a WebSocket upgrade request, the socket has no error listener. If the client resets the TCP connection during that time, the resulting `ECONNRESET` is emitted as an unhandled `'error'` event and the process terminates. ### Details The upgrade handler awaits the application before attaching any listener to the socket. When middleware on the upgrade path does asynchronous work, such as an authentication lookup, a connection reset in that window has no handler. If a global `uncaughtException` handler swallows the error, the pending upgrade is never released and its entry is retained for the lifetime of the process. The fix attaches error and close listeners to the socket before calling the application, releases the pending upgrade when the socket closes, and skips the handshake on a destroyed socket. ### Impact An unauthenticated client can terminate the server process with a single connection by sending a WebSocket upgrade request and resetting the connection before the application has responded. Where the crash is suppressed, repeated requests grow the heap. This affects applications that enable WebSocket support in `@hono/node-server` and run asynchronous middleware or handlers on the upgrade path.
Read the publisher's advisoryCISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.
This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.
No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.
Compare earlier KEV listings and EPSS scores. Advisory wording and affected versions have a separate history.
A prediction change is reported when EPSS rises from below 10% to 10% or higher. Every daily score change from the last 30 days stays in this history. Before that, it keeps KEV changes and moves between EPSS bands (0.1%, 1%, 5%, 10%, 20%, 50% and 90%).
See how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.
Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.
nvd · CVE-2026-126343 · Published
euvd · EUVD-2026-124721 · Published
cve-program · CVE-2026-126343 · Published
cve-program · CVE-2026-126343 · Published
euvd · EUVD-2026-124721 · Published
osv · GHSA-qv5m-9pm6-hqp3 · Published