@1mcp/agent (>=0.39.0-beta.4, <=0.39.3), @aaarc/recursivelearnmcp (>=0.1.0, <=0.1.3) +260 more potentially affected by unknown CVE via @hono/node-server (>=2.0.0, <=2.1.1)

@hono/node-server NPM version =2.0.0, =0.39.0-beta.4, =0.1.0, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.4.0, =0.8.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.8, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.47 and more Source cves: unknown CVE Source advisory:...

Security Bulletin: Security Vulnerabilities in Third-Party Node.js Packages Used by IBM Rhapsody Systems Engineering

Summary Security vulnerabilities were identified in the product's Node.js dependencies. The issue has been mitigated by removing the vulnerable packages and updating dependencies to secure versions. Vulnerability Details CVEID:CVE-2026-29087 DESCRIPTION: @hono/node-server allows running the Hono...

CVE-2026-73565

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave...

CVE-2026-73565 @hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave...

CVE-2026-73565

CVE-2026-73565 affects @hono/node-server

@agent-vm/agent-vm (>=0.0.138, <=0.0.140), @agent-vm/agent-vm-worker (>=0.0.138, <=0.0.140) +122 more potentially affected by CVE-2026-73565 via @hono/node-server (>=2.0.0, <=2.0.9)

@hono/node-server NPM version =2.0.0, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.8.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.9 and more Source cves: CVE-2026-73565 Sourc...

EUVD-2026-58180

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave...

CVE-2026-73565 @hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave...

CVE-2026-73565: Missing Release of Memory after Effective Lifetime

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave...

PT-2026-71713

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js module @hono/node-server

Summary IBM App Connect Enterprise runtime is vulnerable to multiple vulnerabilities due to Node.js module @hono/node-server. Vulnerability Details CVEID:CVE-2026-54286 DESCRIPTION: Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows...

Allocation of Resources Without Limits or Throttling

Overview @hono/node-server is a Node.js Adapter for Hono Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the upgradeWebSocket. An attacker can cause unbounded memory consumption by sending repeated WebSocket upgrade requests with missin...

@agent-vm/agent-vm (>=0.0.138, <=0.0.140), @agent-vm/agent-vm-worker (>=0.0.138, <=0.0.140) +122 more potentially affected by CVE-2026-73565 via @hono/node-server (>=2.0.0, <=2.0.9)

@hono/node-server NPM version =2.0.0, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.8.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.9 and more Source cves: CVE-2026-73565 Sourc...

@agent-vm/agent-vm (>=0.0.138, <=0.0.140), @agent-vm/agent-vm-worker (>=0.0.138, <=0.0.140) +122 more potentially affected by CVE-2026-73565 via @hono/node-server (>=2.0.0, <=2.0.9)

@hono/node-server NPM version =2.0.0, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.8.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.9 and more Source cves: CVE-2026-73565 Sourc...

@agent-vm/agent-vm (>=0.0.138, <=0.0.140), @agent-vm/agent-vm-worker (>=0.0.138, <=0.0.140) +122 more potentially affected by unknown CVE via @hono/node-server (>=2.0.0, <=2.0.9)

@hono/node-server NPM version =2.0.0, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.8.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.9 and more Source cves: unknown CVE Source...

@agent-vm/agent-vm (>=0.0.138, <=0.0.140), @agent-vm/agent-vm-worker (>=0.0.138, <=0.0.140) +105 more potentially affected by unknown CVE via @hono/node-server (>=2.0.0, <=2.0.4)

@hono/node-server NPM version =2.0.0, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.8.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.9 and more Source cves: unknown CVE Source...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @adhisang/minecraft-modding-mcp (1.0.0) +307 more potentially affected by unknown CVE via @hono/node-server (>=1.0.2, <=1.19.14)

@hono/node-server NPM version =1.0.2, =0.3.1, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.1.4, =0.0.27, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =1.0.25-beta.0, =0.0.1, =1.0.0 - @arpanjain3.14/ponder-with-flashblocks 0.16.3 and more Source cves: unknown CVE Source advisory: GHSA-FRVP-7C67-3...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @adhisang/minecraft-modding-mcp (1.0.0) +307 more potentially affected by unknown CVE via @hono/node-server (>=1.0.2, <=1.19.14)

@hono/node-server NPM version =1.0.2, =0.3.1, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.1.4, =0.0.27, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =1.0.25-beta.0, =0.0.1, =1.0.0 - @arpanjain3.14/ponder-with-flashblocks 0.16.3 and more Source cves: unknown CVE Source advisory:...

@agent-vm/agent-vm (>=0.0.138, <=0.0.140), @agent-vm/agent-vm-worker (>=0.0.138, <=0.0.140) +105 more potentially affected by unknown CVE via @hono/node-server (>=2.0.0, <=2.0.4)

@hono/node-server NPM version =2.0.0, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.8.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.9 and more Source cves: unknown CVE Source...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Incorrect Authorization and Middleware Bypass due to Node.js module @hono/node-server ( CVE-2026-29087 & CVE-2026-39406 )

Summary IBM App Connect Enterprise runtime is vulnerable to Incorrect Authorization and Middleware Bypass due to Node.js module @hono/node-server. Vulnerability Details CVEID:CVE-2026-29087 DESCRIPTION: @hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, wh...