Message corruption in the websocket-driver npm package (CVE-2026-54466)

CVE-2026-54466 is a message corruption vulnerability in the websocket-driver npm package affecting draft versions of the WebSocket protocol implementation. A remote, unauthenticated client can send an indefinite sequence of bytes with values 0x80 or above, causing the server to parse them into an ever-growing integer; because JavaScript numbers are 64-bit floating point values, precision loss occurs and subsequent payload data is parsed incorrectly. This vulnerability carries a CVSS v4 score of 9.2 (Critical). Affected versions: - < 0.7.5 We recommend updating to: >= 0.7.5. CVSS 9.2 · our assessment: act_now Vendor advisory: https://github.com/faye/websocket-driver-node/security/advisories/GHSA-xv26-6w52-cph6 Details: https://vuln.today/cve/CVE-2026-54466