Update dependency @hono/node-server to v2.0.10 [SECURITY] #133

Open
renovate-bot wants to merge 1 commit from renovate/npm-hono-node-server-vulnerability into main
Collaborator

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@hono/node-server 2.0.82.0.10 age adoption passing confidence

Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

GHSA-9mqv-5hh9-4cgg

More information

Details

Summary

A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the route is reachable pre-handshake without authentication, an unauthenticated attacker can flood it to gradually exhaust memory.

Details

The built-in WebSocket helper cleans up its internal map only on a successful handshake or when the route guard rejects the request. When ws aborts the handshake because Sec-WebSocket-Key is missing or malformed, no connection event is emitted, so neither cleanup path runs and the entry is retained forever. A present-but-malformed key leaks identically, so a proxy that only checks for the header's presence does not mitigate it.

Impact

An unauthenticated attacker can flood any public upgradeWebSocket route with malformed-key upgrade requests, causing unbounded memory growth and eventual loss of availability. No confidentiality or integrity impact.

Reported by @​TarPeg007.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).


Release Notes

honojs/node-server (@​hono/node-server)

v2.0.10

Compare Source

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg


Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

Compare Source

What's Changed

  • fix(websocket): polyfill missing ErrorEvent global by @​otnc in #​371
  • fix(serve-static): correct Range header parsing edge cases by @​otnc in #​372
  • fix: recover complete request bodies after client disconnect by @​usualoma in #​375

New Contributors

Full Changelog: https://github.com/honojs/node-server/compare/v2.0.8...v2.0.9


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [@hono/node-server](https://github.com/honojs/node-server) | [`2.0.8` → `2.0.10`](https://renovatebot.com/diffs/npm/@hono%2fnode-server/2.0.8/2.0.10) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@hono%2fnode-server/2.0.10?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/@hono%2fnode-server/2.0.10?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/@hono%2fnode-server/2.0.8/2.0.10?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@hono%2fnode-server/2.0.8/2.0.10?slim=true) | --- ### Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake [GHSA-9mqv-5hh9-4cgg](https://github.com/advisories/GHSA-9mqv-5hh9-4cgg) <details> <summary>More information</summary> #### Details ##### Summary A WebSocket upgrade request to an `upgradeWebSocket` route with a missing or malformed `Sec-WebSocket-Key` header leaks memory permanently. The request's `IncomingMessage` is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the route is reachable pre-handshake without authentication, an unauthenticated attacker can flood it to gradually exhaust memory. ##### Details The built-in WebSocket helper cleans up its internal map only on a successful handshake or when the route guard rejects the request. When `ws` aborts the handshake because `Sec-WebSocket-Key` is missing or malformed, no `connection` event is emitted, so neither cleanup path runs and the entry is retained forever. A present-but-malformed key leaks identically, so a proxy that only checks for the header's presence does not mitigate it. ##### Impact An unauthenticated attacker can flood any public `upgradeWebSocket` route with malformed-key upgrade requests, causing unbounded memory growth and eventual loss of availability. No confidentiality or integrity impact. Reported by @&#8203;TarPeg007. #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L` #### References - [https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg](https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg) - [https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1](https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1) - [https://github.com/honojs/node-server](https://github.com/honojs/node-server) - [https://github.com/honojs/node-server/releases/tag/v2.0.10](https://github.com/honojs/node-server/releases/tag/v2.0.10) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-9mqv-5hh9-4cgg) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>honojs/node-server (@&#8203;hono/node-server)</summary> ### [`v2.0.10`](https://github.com/honojs/node-server/releases/tag/v2.0.10) [Compare Source](https://github.com/honojs/node-server/compare/v2.0.9...v2.0.10) #### Security fixes This release includes a fix for the following security issue: ##### Unauthenticated memory-leak DoS via aborted WebSocket handshake Affects: `upgradeWebSocket`. A WebSocket upgrade request with a missing or malformed `Sec-WebSocket-Key` header leaked the request's `IncomingMessage` and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. [GHSA-9mqv-5hh9-4cgg](https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg) *** Users of `upgradeWebSocket` are encouraged to upgrade to this version. ### [`v2.0.9`](https://github.com/honojs/node-server/releases/tag/v2.0.9) [Compare Source](https://github.com/honojs/node-server/compare/v2.0.8...v2.0.9) #### What's Changed - fix(websocket): polyfill missing ErrorEvent global by [@&#8203;otnc](https://github.com/otnc) in [#&#8203;371](https://github.com/honojs/node-server/pull/371) - fix(serve-static): correct Range header parsing edge cases by [@&#8203;otnc](https://github.com/otnc) in [#&#8203;372](https://github.com/honojs/node-server/pull/372) - fix: recover complete request bodies after client disconnect by [@&#8203;usualoma](https://github.com/usualoma) in [#&#8203;375](https://github.com/honojs/node-server/pull/375) #### New Contributors - [@&#8203;otnc](https://github.com/otnc) made their first contribution in [#&#8203;371](https://github.com/honojs/node-server/pull/371) **Full Changelog**: <https://github.com/honojs/node-server/compare/v2.0.8...v2.0.9> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjQuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjY1LjUiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImJhY2tlbmQiLCJyZW5vdmF0ZSJdfQ==-->
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/npm-hono-node-server-vulnerability:renovate/npm-hono-node-server-vulnerability
git switch renovate/npm-hono-node-server-vulnerability

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff renovate/npm-hono-node-server-vulnerability
git switch renovate/npm-hono-node-server-vulnerability
git rebase main
git switch main
git merge --ff-only renovate/npm-hono-node-server-vulnerability
git switch renovate/npm-hono-node-server-vulnerability
git rebase main
git switch main
git merge --no-ff renovate/npm-hono-node-server-vulnerability
git switch main
git merge --squash renovate/npm-hono-node-server-vulnerability
git switch main
git merge --ff-only renovate/npm-hono-node-server-vulnerability
git switch main
git merge renovate/npm-hono-node-server-vulnerability
git push origin main
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
MobiusReactor/TicTacToeV2!133
No description provided.