facil.io CVE-2026-16632

The target application must be running facil.io version 0.7.4 or earlier with WebSocket support enabled and a WebSocket endpoint reachable from the attacker over the network. Per the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N), no authentication, user interaction, or special attack preconditions are required beyond network connectivity to the WebSocket endpoint. The principal limiting factor is that WebSocket functionality must be active and the relevant endpoint exposed - applications that do not enable WebSocket support or that sit behind a strict reverse proxy blocking WebSocket upgrades are not directly reachable via this path. Impact is bounded to low levels across confidentiality, integrity, and availability (VC:L/VI:L/VA:L); no scope change or system-level compromise is indicated.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is remotely exploitable without authentication or user interaction and with no special attack preconditions, indicating a broad attack surface for any exposed WebSocket endpoint. The E:P (proof-of-concept exists) threat modifier elevates practical risk above a theoretical finding. However, impact metrics (VC:L/VI:L/VA:L with SC:N/SI:N/SA:N) indicate only limited, contained impact with no scope change - this is not a remote code execution class issue based on available data. The aggregate CVSS 4.0 score of 5.5 (Medium) is consistent with limited blast radius. No CISA KEV listing means active exploitation in the wild has not been confirmed by a government authority. The lack of any vendor patch, combined with public PoC availability, means the risk window is open-ended. For facil.io deployments with internet-facing WebSocket endpoints, the PoC and unpatched status meaningfully elevate real-world priority despite the medium score.

An unauthenticated remote attacker connects to a facil.io WebSocket endpoint and sends a crafted WebSocket frame with a malformed or unexpected on_message payload designed to trigger the protocol error handler. The websocket_on_protocol_error function's improper validation fails to sanitize the input, causing the parser to process attacker-controlled data in an unintended way, potentially leaking memory contents or causing limited corruption of server state. A proof-of-concept exploit has been published, meaning this scenario requires only moderate attacker skill to execute.