websocket-driver CVE-2026-54463

Upgrade websocket-driver to version 0.8.1 or later, which is the vendor-confirmed patched release per the GitHub security advisory at https://github.com/faye/websocket-driver-ruby/security/advisories/GHSA-ghhp-3qvg-889p. Update your Gemfile to require 'websocket-driver', '>= 0.8.1' and run bundle update websocket-driver, then verify the installed version with bundle list. The advisory explicitly states no known workarounds exist. If immediate patching is not possible, compensating controls with trade-offs include: restricting WebSocket endpoint access to authenticated or known-IP clients at the load balancer or WAF layer (trade-off: breaks legitimate anonymous WebSocket consumers); setting aggressive TCP idle-timeout and per-connection memory limits at the server or reverse proxy level to limit per-connection damage (trade-off: may disrupt legitimate long-lived connections); and deploying the application in containerized or process-isolated environments so that an OOM kill is scoped to a single worker and does not affect the full service (trade-off: operational complexity, not a prevention).