The honojs node-server package, versions 2.0.0 through 2.0.9, improperly handles WebSocket upgrade requests that lack a valid Sec-WebSocket-Key header. Specifically, the src/websocket.ts module retains the IncomingMessage object in waiterMap and leaves the waitForWebSocket promise pending because the ws.handleUpgrade method does not emit a connection event in this scenario. This results in an aborted handshake without cleanup, causing memory to accumulate unboundedly. This vulnerability can be exploited by unauthenticated attackers flooding a public route with such malformed requests, leading to denial of service due to memory exhaustion. The vulnerability is addressed in version 2.0.10.

An unauthenticated attacker can exploit this vulnerability by sending WebSocket upgrade requests with missing or malformed Sec-WebSocket-Key headers to a public route, causing the server to retain memory indefinitely. This leads to unbounded memory growth and can result in denial of service by exhausting system resources. There is no impact on confidentiality or integrity, only availability is affected.

Upgrade honojs node-server to version 2.0.10 or later, where this issue is fixed. Patch status is confirmed by the version fix information. No other mitigation is indicated by the vendor advisory.