The @hono/node-server WebSocket helper retains IncomingMessage objects in an internal map when a WebSocket upgrade request has a missing or malformed Sec-WebSocket-Key header. Because the handshake is aborted without emitting a connection event, the cleanup routines do not run, causing the memory to leak indefinitely. Since the upgradeWebSocket route is accessible without authentication, an attacker can flood it with such malformed requests to exhaust server memory and cause a denial of service. This vulnerability affects versions >=2.0.0 and <2.0.10.

An unauthenticated attacker can cause unbounded memory growth on any public upgradeWebSocket route by sending malformed WebSocket upgrade requests, leading to denial of service due to memory exhaustion. There is no impact on data confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing request validation or filtering at a proxy level, but note that simply checking for the presence of the Sec-WebSocket-Key header is insufficient to prevent the leak. Monitor for updates from the vendor regarding an official fix.