{"api_version":"1","generated_at":"2026-11-12T23:35:36+00:00","cve":"CVE-2026-126343","urls":{"html":"https://cve.report/CVE-2026-126343","api":"https://cve.report/api/cve/CVE-2026-126343.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-126343","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-126343"},"summary":{"title":"@hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process","description":"@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the TCP connection during that window, the socket emits an unhandled ECONNRESET error and terminates the Node.js process. If a global uncaughtException handler suppresses termination, the pending upgrade waiter is not released and repeated requests can grow the heap. This affects applications that enable WebSocket support and perform asynchronous work on the upgrade path. This issue is fixed in version 2.1.6.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-11-12 22:19:19","updated_at":"2026-11-12 22:19:19"},"problem_types":["CWE-248","CWE-248 CWE-248: Uncaught Exception"],"metrics":[{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}}],"references":[{"url":"https://github.com/honojs/node-server/commit/61cc0267e613e684401f17c27538ba3bf97339a4","name":"https://github.com/honojs/node-server/commit/61cc0267e613e684401f17c27538ba3bf97339a4","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/honojs/node-server/releases/tag/v2.1.6","name":"https://github.com/honojs/node-server/releases/tag/v2.1.6","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/honojs/node-server/security/advisories/GHSA-qv5m-9pm6-hqp3","name":"https://github.com/honojs/node-server/security/advisories/GHSA-qv5m-9pm6-hqp3","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-126343","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126343","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"honojs","product":"node-server","version":"affected >= 2.0.0, < 2.1.6","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"product":"node-server","vendor":"honojs","versions":[{"status":"affected","version":">= 2.0.0, < 2.1.6"}]}],"descriptions":[{"lang":"en","value":"@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the TCP connection during that window, the socket emits an unhandled ECONNRESET error and terminates the Node.js process. If a global uncaughtException handler suppresses termination, the pending upgrade waiter is not released and repeated requests can grow the heap. This affects applications that enable WebSocket support and perform asynchronous work on the upgrade path. This issue is fixed in version 2.1.6."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-248","description":"CWE-248: Uncaught Exception","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T21:27:05.380Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/honojs/node-server/security/advisories/GHSA-qv5m-9pm6-hqp3","tags":["x_refsource_CONFIRM"],"url":"https://github.com/honojs/node-server/security/advisories/GHSA-qv5m-9pm6-hqp3"},{"name":"https://github.com/honojs/node-server/commit/61cc0267e613e684401f17c27538ba3bf97339a4","tags":["x_refsource_MISC"],"url":"https://github.com/honojs/node-server/commit/61cc0267e613e684401f17c27538ba3bf97339a4"},{"name":"https://github.com/honojs/node-server/releases/tag/v2.1.6","tags":["x_refsource_MISC"],"url":"https://github.com/honojs/node-server/releases/tag/v2.1.6"}],"source":{"advisory":"GHSA-qv5m-9pm6-hqp3","discovery":"UNKNOWN"},"title":"@hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-126343","datePublished":"2026-11-12T21:27:05.380Z","dateReserved":"2026-11-10T21:12:01.226Z","dateUpdated":"2026-11-12T21:27:05.380Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-12 22:19:19","lastModifiedDate":"2026-11-12 22:19:19","problem_types":["CWE-248","CWE-248 CWE-248: Uncaught Exception"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"126343","Ordinal":"1","Title":"@hono/node-server: Unhandled `ECONNRESET` on the socket during a","CVE":"CVE-2026-126343","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"126343","Ordinal":"1","NoteData":"@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the TCP connection during that window, the socket emits an unhandled ECONNRESET error and terminates the Node.js process. If a global uncaughtException handler suppresses termination, the pending upgrade waiter is not released and repeated requests can grow the heap. This affects applications that enable WebSocket support and perform asynchronous work on the upgrade path. This issue is fixed in version 2.1.6.","Type":"Description","Title":"@hono/node-server: Unhandled `ECONNRESET` on the socket during a"}]}}}