CVE-2026-126343
- Source
- https://cve.org/CVERecord?id=CVE-2026-126343
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126343.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-126343
- Aliases
- Downstream
- Published
- 2026-11-12T21:27:05Z
- Modified
- 2026-11-13T10:46:19Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- @hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process
- Details
-
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the TCP connection during that window, the socket emits an unhandled ECONNRESET error and terminates the Node.js process. If a global uncaughtException handler suppresses termination, the pending upgrade waiter is not released and repeated requests can grow the heap. This affects applications that enable WebSocket support and perform asynchronous work on the upgrade path. This issue is fixed in version 2.1.6.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-248" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126343.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126343.json
- https://github.com/honojs/node-server/commit/61cc0267e613e684401f17c27538ba3bf97339a4
- https://github.com/honojs/node-server/releases/tag/v2.1.6
- https://github.com/honojs/node-server/security/advisories/GHSA-qv5m-9pm6-hqp3
- https://nvd.nist.gov/vuln/detail/CVE-2026-126343
Affected packages
Git / github.com/honojs/node-server
Affected ranges
- Type
- GIT
- Repo
- https://github.com/honojs/node-server
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "2.0.0" }, { "fixed": "2.1.6" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "61cc0267e613e684401f17c27538ba3bf97339a4" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v2.1.6", "range": [ { "fixed": "123f78269626704eb7f4d85a9529e357315ba051" } ], "source": "REFERENCES_TAG" } ] }