Skip to main content

ws CVE-2026-45736

| EUVDEUVD-2026-30543 HIGH
Use of Uninitialized Resource (CWE-908)
2026-05-15 security-advisories@github.com GHSA-58qx-3vcg-4xpx
Information Disclosure Node.js Ws Ws Project
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
7.5 HIGH

Network-reachable and unauthenticated, but AC:H because it requires the app to use a TypedArray close reason, and C:L since only opportunistic uninitialized heap leaks.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
4.4 MEDIUM
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Red Hat
7.5 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

10
Analysis Updated
Jun 30, 2026 - 04:20 vuln.today
v5 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 04:19 vuln.today
v4 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 04:19 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 04:16 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 30, 2026 - 03:24 vuln.today
cvss_changed
Severity Changed
Jun 30, 2026 - 03:24 NVD
MEDIUM HIGH
CVSS changed
Jun 30, 2026 - 03:24 NVD
4.4 (MEDIUM) 7.5 (HIGH)
Patch available
May 15, 2026 - 16:01 EUVD
Source Code Evidence Fetched
May 15, 2026 - 15:30 vuln.today
Analysis Generated
May 15, 2026 - 15:30 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 31 npm packages depend on ws (21 direct, 11 indirect)

Ecosystem-wide dependent count for version 8.0.0.

DescriptionNVD

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

AnalysisAI

Uninitialized memory disclosure in the ws WebSocket library for Node.js (versions 8.0.0 through 8.20.0) allows a connected peer to receive leaked process memory when an application calls websocket.close() with a TypedArray as the reason argument. Because the close-frame reason buffer is not zero-initialized, fragments of adjacent heap memory - potentially containing secrets, tokens, or other clients' data - are transmitted over the wire. No public exploit is identified at time of analysis (SSVC lists POC-class maturity but EPSS is only 0.01%), and the issue is fixed in ws 8.20.1.

Technical ContextAI

ws is one of the most widely used WebSocket client/server implementations in the Node.js ecosystem, shipped as a transitive dependency of countless frameworks (Socket.IO, express-ws, etc.). The flaw is rooted in CWE-908 (Use of Uninitialized Resource): when websocket.close(code, reason) is invoked with a TypedArray reason, ws allocates a buffer for the close-frame payload without fully initializing it, so previously-freed or never-written heap bytes are copied into the outbound frame. The affected component is identified by CPE cpe:2.3:a:ws_project:ws for the node.js target. The control frame's reason field is then sent to the remote peer per RFC 6455, turning an internal memory-handling bug into a network-observable information leak.

RemediationAI

Vendor-released patch: ws 8.20.1 - upgrade the ws dependency (including transitive copies pulled in by frameworks such as Socket.IO) to 8.20.1 or later, then audit your lockfile to ensure no nested older copies remain. Red Hat consumers should apply the corresponding errata (RHSA-2026:7655, RHSA-2026:26638, RHSA-2026:26994, RHSA-2026:27171, RHSA-2026:29197) via the platform package manager; see https://access.redhat.com/errata/RHSA-2026:29197 and the advisory at https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx. If you cannot upgrade immediately, a targeted compensating control is to ensure application code never passes a TypedArray (e.g., Uint8Array) to websocket.close() - instead pass the reason as a string or omit it - which avoids the vulnerable allocation path entirely; the trade-off is a code change in every place that closes a socket with a binary reason, but it has no protocol-level side effects since string reasons are fully supported by RFC 6455. The upstream fix commit is https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-45736 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy