Skip to main content

websocket-driver CVE-2026-54490

| EUVDEUVD-2026-45336 MEDIUM
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-07-15 https://github.com/faye/websocket-driver-node GHSA-mp7j-qc5w-4988
Denial Of Service Suse
6.3
CVSS 4.0 · Vendor: https://github.com/faye/websocket-driver-node
Share

Severity by source

Vendor (https://github.com/faye/websocket-driver-node) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable via WebSocket handshake, no authentication or user interaction needed; availability impact is high due to unbounded memory expansion from decompressed payloads.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from Vendor (https://github.com/faye/websocket-driver-node).

CVSS VectorVendor: https://github.com/faye/websocket-driver-node

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
CVSS changed
Jul 17, 2026 - 21:22 NVD
6.3 (MEDIUM)
Source Code Evidence Fetched
Jul 15, 2026 - 22:32 vuln.today
Analysis Generated
Jul 15, 2026 - 22:32 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 92,418 npm packages depend on websocket-driver (1,723 direct, 90,705 indirect)

Ecosystem-wide dependent count for version 0.7.5.

DescriptionCVE.org

Impact

If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage.

Patches

The issue has been patched in version 0.7.5, by checking the length of messages after they are processed by incoming extensions. All users should upgrade to this version.

Workarounds

No known workarounds exist.

Acknowledgements

This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.

AnalysisAI

Resource limit bypass in the websocket-driver npm library (versions < 0.7.5) allows WebSocket messages to exceed the application's configured maximum message size when the permessage-deflate compression extension is active. The size enforcement is applied to compressed frame length headers rather than the decompressed payload, meaning a highly compressed message can appear within limits on the wire but expand arbitrarily upon decompression. Vendor-released patch is available in version 0.7.5; no public exploit has been identified at time of analysis.

Technical ContextAI

The websocket-driver package (pkg:npm/websocket-driver) is a Node.js library from the faye ecosystem that implements the WebSocket protocol. The permessage-deflate extension (RFC 7692) is an optional WebSocket compression mechanism negotiated during the handshake that compresses message payloads using DEFLATE. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the library's maximum message size guard evaluates the size field carried in the compressed frame header rather than the byte count of the data after the extension pipeline processes it. Because compression ratios for repetitive or crafted payloads can be extreme (e.g., a zip-bomb-style input), an attacker can craft messages that are small in compressed form but many times larger after decompression, entirely bypassing the application's intended memory and resource constraints. The fix in 0.7.5 relocates the size check to occur after incoming extensions have processed the frame.

RemediationAI

Vendor-released patch: 0.7.5. All users of websocket-driver should upgrade to version 0.7.5 immediately, available via npm (npm install websocket-driver@0.7.5) and documented at https://github.com/faye/websocket-driver-node/releases/tag/0.7.5. The fix applies the message size check after decompression by the extension pipeline, correctly enforcing configured limits. The vendor advisory at https://github.com/faye/websocket-driver-node/security/advisories/GHSA-mp7j-qc5w-4988 confirms no known workarounds exist. If upgrade cannot be applied immediately, a compensating control is to disable the permessage-deflate extension at the application layer - this eliminates the vulnerable code path entirely but removes WebSocket compression, which may increase bandwidth consumption and reduce throughput for high-volume applications. Alternatively, deploying an upstream reverse proxy or WAF that enforces hard limits on WebSocket frame and message sizes at the network layer can reduce exposure, though this does not fix the root cause.

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-41770 HIGH
8.7
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-54490 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy