ws project vulnerabilities (CVE)

CVE records published for ws project, newest first. Follow to get an email when a new one appears.

2 results

7.5High

CVE-2026-48779 4 months ago

ws: Memory exhaustion DoS from tiny fragments and data chunks

websockets ws; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer c…

1.4%EPSS

4.4Medium

CVE-2026-45736 6 months ago

ws: Uninitialized memory disclosure

websockets ws; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.