GHSA-9mqv-5hh9-4cgg: Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request’s IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the route is reachable pre-handshake without authentication, an unauthenticated attacker can flood it to gradually exhaust memory.