CVE-2026-126343: @hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process

November 12, 2026

While @hono/node-server waits for the Hono application to handle a WebSocket upgrade request, the socket has no error listener. If the client resets the TCP connection during that time, the resulting ECONNRESET is emitted as an unhandled 'error' event and the process terminates.

References

github.com/advisories/GHSA-qv5m-9pm6-hqp3
github.com/honojs/node-server/commit/61cc0267e613e684401f17c27538ba3bf97339a4
github.com/honojs/node-server/releases/tag/v2.1.6
github.com/honojs/node-server/security/advisories/GHSA-qv5m-9pm6-hqp3
nvd.nist.gov/vuln/detail/CVE-2026-126343

Code Behaviors & Features

Detect and mitigate CVE-2026-126343 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →