Update dependency @hono/node-server to v2.0.10 [SECURITY] #133
No reviewers
Labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
MobiusReactor/TicTacToeV2!133
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/npm-hono-node-server-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
2.0.8→2.0.10Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake
GHSA-9mqv-5hh9-4cgg
More information
Details
Summary
A WebSocket upgrade request to an
upgradeWebSocketroute with a missing or malformedSec-WebSocket-Keyheader leaks memory permanently. The request'sIncomingMessageis retained in an internal map and a pending promise is never settled, even though no connection is established. Since the route is reachable pre-handshake without authentication, an unauthenticated attacker can flood it to gradually exhaust memory.Details
The built-in WebSocket helper cleans up its internal map only on a successful handshake or when the route guard rejects the request. When
wsaborts the handshake becauseSec-WebSocket-Keyis missing or malformed, noconnectionevent is emitted, so neither cleanup path runs and the entry is retained forever. A present-but-malformed key leaks identically, so a proxy that only checks for the header's presence does not mitigate it.Impact
An unauthenticated attacker can flood any public
upgradeWebSocketroute with malformed-key upgrade requests, causing unbounded memory growth and eventual loss of availability. No confidentiality or integrity impact.Reported by @TarPeg007.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
honojs/node-server (@hono/node-server)
v2.0.10Compare Source
Security fixes
This release includes a fix for the following security issue:
Unauthenticated memory-leak DoS via aborted WebSocket handshake
Affects:
upgradeWebSocket. A WebSocket upgrade request with a missing or malformedSec-WebSocket-Keyheader leaked the request'sIncomingMessageand left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cggUsers of
upgradeWebSocketare encouraged to upgrade to this version.v2.0.9Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/honojs/node-server/compare/v2.0.8...v2.0.9
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.