chore(deps): update @hono/node-server@<2.0.5 to v2.0.12 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@hono/node-server@<2.0.5	>=2.0.5 → >=2.0.12

---

Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

GHSA-9mqv-5hh9-4cgg

More information

Details

Summary

A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the route is reachable pre-handshake without authentication, an unauthenticated attacker can flood it to gradually exhaust memory.

Details

The built-in WebSocket helper cleans up its internal map only on a successful handshake or when the route guard rejects the request. When ws aborts the handshake because Sec-WebSocket-Key is missing or malformed, no connection event is emitted, so neither cleanup path runs and the entry is retained forever. A present-but-malformed key leaks identically, so a proxy that only checks for the header's presence does not mitigate it.

Impact

An unauthenticated attacker can flood any public upgradeWebSocket route with malformed-key upgrade requests, causing unbounded memory growth and eventual loss of availability. No confidentiality or integrity impact.

Reported by @​TarPeg007.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg
• https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1
• https://github.com/honojs/node-server
• https://github.com/honojs/node-server/releases/tag/v2.0.10

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

honojs/node-server (@​hono/node-server@<2.0.5)

v2.0.12

Compare Source

What's Changed

• test: replace supertest by @​BlankParticle in #​379
• fix(response): copy headers when init is a foreign Response by @​yusukebe in #​382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

Compare Source

What's Changed

• test: use a custom helper for path traversal tests by @​BlankParticle in #​377
• perf(request): fast-path QUERY methods by @​usualoma in #​376
• perf(request): fast-path PATCH method by @​yusukebe in #​380

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Compare Source

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

---

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

Compare Source

What's Changed

• fix(websocket): polyfill missing ErrorEvent global by @​otnc in #​371
• fix(serve-static): correct Range header parsing edge cases by @​otnc in #​372
• fix: recover complete request bodies after client disconnect by @​usualoma in #​375

New Contributors

• @​otnc made their first contribution in #​371

Full Changelog: honojs/node-server@v2.0.8...v2.0.9

v2.0.8

Compare Source

What's Changed

• ci(release): add --no-git-checks option for pnpm stage publish by @​yusukebe in #​369

Full Changelog: honojs/node-server@v2.0.7...v2.0.8

v2.0.6

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Scope: all 2 workspace projects
? Verifying lockfile against supply-chain policies (886 entries)...
✗ Lockfile failed supply-chain policy check (886 entries in 7.2s)
[ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION] 3 lockfile entries failed verification:
  @hono/node-server@2.1.0 was published at 2026-08-04T02:50:49.000Z, within the minimumReleaseAge cutoff (2026-08-03T12:19:57.395Z)
  hono@4.13.0 was published at 2026-08-03T21:47:05.000Z, within the minimumReleaseAge cutoff (2026-08-03T12:19:57.395Z)
  ws@8.21.2 was published at 2026-08-03T20:37:45.880Z, within the minimumReleaseAge cutoff (2026-08-03T12:19:57.395Z)

The lockfile contains entries that the active policies reject. This can mean the lockfile is stale, or that someone committed a lockfile that bypassed the policy locally — inspect recent changes to pnpm-lock.yaml before trusting it. If the changes look expected, run "pnpm clean --lockfile" and then "pnpm install" to rebuild from a fresh resolution. Alternatively, relax the policy that flagged them.