chore(deps): update @hono/node-server@<2.0.5 to v2.1.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@hono/node-server@<2.0.5	>=2.0.5 → >=2.1.0

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

GHSA-9mqv-5hh9-4cgg

More information

Details

Summary

A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the route is reachable pre-handshake without authentication, an unauthenticated attacker can flood it to gradually exhaust memory.

Details

The built-in WebSocket helper cleans up its internal map only on a successful handshake or when the route guard rejects the request. When ws aborts the handshake because Sec-WebSocket-Key is missing or malformed, no connection event is emitted, so neither cleanup path runs and the entry is retained forever. A present-but-malformed key leaks identically, so a proxy that only checks for the header's presence does not mitigate it.

Impact

An unauthenticated attacker can flood any public upgradeWebSocket route with malformed-key upgrade requests, causing unbounded memory growth and eventual loss of availability. No confidentiality or integrity impact.

Reported by @​TarPeg007.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg
• https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1
• https://github.com/honojs/node-server
• https://github.com/honojs/node-server/releases/tag/v2.0.10

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

honojs/node-server (@​hono/node-server@<2.0.5)

v2.1.0

Compare Source

What's Changed

• feat: add Early Hints (HTTP 103) middleware by @​bilal-azam in #​378
• fix(listener): avoid uncaught error when force-closing a non-standard socket by @​mohamedramadan14 in #​383

New Contributors

• @​bilal-azam made their first contribution in #​378
• @​mohamedramadan14 made their first contribution in #​383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

Compare Source

What's Changed

• test: replace supertest by @​BlankParticle in #​379
• fix(response): copy headers when init is a foreign Response by @​yusukebe in #​382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

Compare Source

What's Changed

• test: use a custom helper for path traversal tests by @​BlankParticle in #​377
• perf(request): fast-path QUERY methods by @​usualoma in #​376
• perf(request): fast-path PATCH method by @​yusukebe in #​380

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Compare Source

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

---

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

Compare Source

What's Changed

• fix(websocket): polyfill missing ErrorEvent global by @​otnc in #​371
• fix(serve-static): correct Range header parsing edge cases by @​otnc in #​372
• fix: recover complete request bodies after client disconnect by @​usualoma in #​375

New Contributors

• @​otnc made their first contribution in #​371

Full Changelog: honojs/node-server@v2.0.8...v2.0.9

v2.0.8

Compare Source

What's Changed

• ci(release): add --no-git-checks option for pnpm stage publish by @​yusukebe in #​369

Full Changelog: honojs/node-server@v2.0.7...v2.0.8

v2.0.6

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud