websocket-driver CVE-2026-54490

Exploitation requires two specific conditions to be met simultaneously: the target application must use the websocket-driver npm package in a version prior to 0.7.5, and the permessage-deflate WebSocket compression extension must be negotiated and active on the connection. The permessage-deflate extension is not enabled by default in all configurations - it must be explicitly supported and accepted by the server or client. Both server-side and client-side deployments of websocket-driver are affected depending on which endpoint processes incoming compressed frames. Limiting factors include: the extension negotiation requirement (attacker must confirm the endpoint supports permessage-deflate), impact restricted to resource exhaustion with no code execution or data exposure, and the need for sustained or repeated message delivery to meaningfully exhaust resources. There is no requirement for authentication or prior session state beyond completing the WebSocket handshake.

No CVSS vector was supplied for this CVE, so all metric assessments are independently derived. The vulnerability is network-exploitable with no authentication required and no user interaction needed, placing it in a high-severity category by vector alone. However, the real-world impact is bounded to Denial of Service (resource exhaustion) with no confidentiality or integrity consequences. The critical limiting factor is that the permessage-deflate extension must be actively negotiated between the two WebSocket peers - applications that do not enable this extension are not affected. No EPSS score is available, no KEV listing exists, and no public proof-of-concept has been identified, suggesting exploitation has not been observed in the wild. Overall, this is a genuine risk for Node.js services that use websocket-driver with compression enabled at scale, but the absence of code execution impact and the configuration prerequisite lower the operational priority compared to a typical unauthenticated RCE.

An attacker with network access to a WebSocket endpoint running websocket-driver < 0.7.5 initiates a connection and negotiates the permessage-deflate extension during the WebSocket handshake. The attacker then transmits a series of crafted compressed frames containing repetitive or specially structured data that decompresses to payloads far exceeding the server's configured maximum message size. Because the size check evaluates only the compressed frame headers, the server accepts each frame and expands the decompressed content into memory, potentially exhausting available resources and causing service degradation or unavailability. No public exploit code has been identified at time of analysis.