Update dependency @hono/node-server to v2.0.10 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@hono/node-server	2.0.5 → 2.0.10

---

Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

GHSA-9mqv-5hh9-4cgg

More information

Details

Summary

A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the route is reachable pre-handshake without authentication, an unauthenticated attacker can flood it to gradually exhaust memory.

Details

The built-in WebSocket helper cleans up its internal map only on a successful handshake or when the route guard rejects the request. When ws aborts the handshake because Sec-WebSocket-Key is missing or malformed, no connection event is emitted, so neither cleanup path runs and the entry is retained forever. A present-but-malformed key leaks identically, so a proxy that only checks for the header's presence does not mitigate it.

Impact

An unauthenticated attacker can flood any public upgradeWebSocket route with malformed-key upgrade requests, causing unbounded memory growth and eventual loss of availability. No confidentiality or integrity impact.

Reported by @​TarPeg007.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg
• https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1
• https://github.com/honojs/node-server
• https://github.com/honojs/node-server/releases/tag/v2.0.10

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

honojs/node-server (@​hono/node-server)

v2.0.10

Compare Source

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

---

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

Compare Source

What's Changed

• fix(websocket): polyfill missing ErrorEvent global by @​otnc in #​371
• fix(serve-static): correct Range header parsing edge cases by @​otnc in #​372
• fix: recover complete request bodies after client disconnect by @​usualoma in #​375

New Contributors

• @​otnc made their first contribution in #​371

Full Changelog: honojs/node-server@v2.0.8...v2.0.9

v2.0.8

Compare Source

What's Changed

• ci(release): add --no-git-checks option for pnpm stage publish by @​yusukebe in #​369

Full Changelog: honojs/node-server@v2.0.7...v2.0.8

v2.0.6

Compare Source

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 62d34ea2-1df7-4610-b572-1ea398c96eda

📥 Commits

Reviewing files that changed from the base of the PR and between 008cebb and 40169bc.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• pnpm-workspace.yaml

---

📝 Walkthrough

Walkthrough

The pnpm workspace catalog updates @hono/node-server from version 2.0.5 to 2.0.10.

Changes

Workspace dependency update

Layer / File(s)	Summary
Catalog version update pnpm-workspace.yaml	The catalog entry for @hono/node-server is updated from 2.0.5 to 2.0.10.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Poem

I’m a bunny with a version to hop,
From five to ten, the updates don’t stop.
The workspace is neat,
With fresh package feet—
A tiny change makes the catalog pop!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the dependency security update to @hono/node-server v2.0.10.
Description check	✅ Passed	The description matches the change and explains the security fix for the updated package.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/npm-hono-node-server-vulnerability

---

_{Comment @coderabbitai help to get the list of available commands.}