Skip to main content

websocket-driver CVE-2026-54466

| EUVDEUVD-2026-45335 CRITICAL
Improper Handling of Length Parameter Inconsistency (CWE-130)
2026-07-15 https://github.com/faye/websocket-driver-node GHSA-xv26-6w52-cph6
Information Disclosure
Critical
Disputed · 9.2 Vendor: https://github.com/faye/websocket-driver-node
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (https://github.com/faye/websocket-driver-node) PRIMARY
9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.6 HIGH

Remote, unauthenticated, no-interaction trigger (AV:N/AC:L/PR:N/UI:N); parser desync corrupts adjacent messages so S:C with I:H, and no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: https://github.com/faye/websocket-driver-node

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
Analysis Updated
Jul 17, 2026 - 21:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 17, 2026 - 21:22 vuln.today
cvss_changed
CVSS changed
Jul 17, 2026 - 21:22 NVD
9.2 (CRITICAL)
Source Code Evidence Fetched
Jul 15, 2026 - 22:31 vuln.today
Analysis Generated
Jul 15, 2026 - 22:31 vuln.today
CVE Published
Jul 15, 2026 - 22:07 cve.org
CRITICAL

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 92,396 npm packages depend on websocket-driver (1,723 direct, 90,683 indirect)

Ecosystem-wide dependent count for version 0.7.5.

DescriptionCVE.org

Impact

The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer. Since JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly.

Patches

The issue has been patched in version 0.7.5 by rejecting the message if the length header exceeds the configured maximum message length. All users should upgrade to this version.

Workarounds

No known workarounds exist.

Acknowledgements

This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.

AnalysisAI

Message corruption in the faye websocket-driver Node.js library (npm websocket-driver, versions < 0.7.5) lets a remote unauthenticated client desynchronize WebSocket frame parsing by abusing the draft-protocol length header. Because the length is accumulated into a JavaScript 64-bit float, an attacker can stream bytes with the high bit set until the integer loses precision, causing the server to misparse the subsequent payload and corrupting message boundaries. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the primary consequence is integrity (data corruption/injection), not code execution or confidentiality loss.

Technical ContextAI

websocket-driver is the protocol state-machine library underpinning faye and faye-websocket, providing WebSocket framing/handshake logic for Node.js servers. The flaw lives in the legacy draft-75/draft protocol frame decoder (lib/websocket/driver/draft75.js), where the frame length is encoded as a variable-length sequence of bytes each having the high bit (0x80) set as a continuation marker. The decoder accumulates these into a running _length integer without bounding it, and since JavaScript has no native 64-bit integer for this path (numbers are IEEE-754 doubles), values beyond 2^53 silently lose precision. This maps to CWE-130 (Improper Handling of Length Parameter Inconsistency): the declared length is trusted and accumulated unchecked, so the parser's notion of where the frame ends diverges from reality, misaligning subsequent payload parsing.

RemediationAI

Vendor-released patch: 0.7.5 - upgrade websocket-driver to 0.7.5 or later, which rejects any frame whose length header exceeds the configured maximum message length (the added check if (this._length > this._maxLength) return this.close(); in draft75.js). Because the package is commonly a transitive dependency, run npm ls websocket-driver and force resolution (e.g. npm overrides or updating faye-websocket) so nested copies are also bumped. No known workarounds exist per the advisory; if immediate patching is impossible, compensating controls are limited but include fronting the WebSocket endpoint with a proxy/gateway that enforces a strict maximum frame/message size and rejects oversized length headers, and disabling negotiation of legacy draft WebSocket protocol versions in favor of RFC 6455 where the deployment allows - with the trade-off that dropping draft support can break very old clients. See GHSA-xv26-6w52-cph6 and the 0.7.5 release notes for authoritative guidance.

Same weakness CWE-130 – Improper Handling of Length Parameter Inconsistency

View all
CVE-2022-1543 HIGH POC
8.8
CVE-2022-3290 HIGH POC
7.5
CVE-2022-3272 HIGH POC
7.5
CVE-2022-2714 CRITICAL
9.8
CVE-2021-20588 CRITICAL
9.8
CVE-2026-67292 CRITICAL
9.3
CVE-2024-42460 MEDIUM POC
5.3
CVE-2026-9054 CRITICAL
9.2

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-54466 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy