Skip to main content

ws EUVDEUVD-2026-30543

| CVE-2026-45736 HIGH
Use of Uninitialized Resource (CWE-908)
2026-05-15 security-advisories@github.com GHSA-58qx-3vcg-4xpx
Information Disclosure Node.js Ws Ws Project
7.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Connect as WebSocket peer
  2. Delivery
    Application closes with TypedArray reason
  3. Exploit
    ws sends uninitialized buffer in close frame
  4. Execution
    Attacker reads leaked heap memory
  5. Impact
    Recover adjacent secrets

Vulnerability Assessment

Weakness
CWE
CWE-908
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
Exploitation Conditions

The decisive prerequisite is that the host application invokes websocket.close() with a TypedArray (e.g., Uint8Array/Buffer view) supplied as the reason argument - closing with a string reason or no reason does not trigger the leak. The attacker must be a connected WebSocket peer (network reachable, no authentication required per PR:N) positioned to receive the close frame's reason field. Limiting factors: the leak only occurs on the close handshake path and only for applications that use binary close reasons, which is not the default or most common usage; affected scope is ws 8.0.0 through 8.20.0 on Node.js; and disclosed bytes are opportunistic uninitialized heap, so an attacker cannot deterministically choose what memory is exposed.
Impact

Signals are mixed and should be weighed rather than taken at the 7.5/CVSS face value. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H) drives the High rating purely on confidentiality, but the practical trigger depends on the host application choosing to pass a TypedArray to close() - a non-default code pattern - which is not reflected in the AC:L metric. EPSS is extremely low (0.01%, 1st percentile) and the issue is NOT in CISA KEV, while SSVC records Exploitation: poc, Automatable: no, Technical Impact: partial. These are internally consistent: a real but low-urgency information-disclosure bug, not a wormable RCE. The CVSS confidentiality of C:H may overstate impact since leaked data is opportunistic uninitialized memory rather than a guaranteed read of targeted secrets. Net: patch as routine hygiene, not an emergency, unless your application is known to pass binary reasons to close().
Exploit ScenarioDerived

An attacker establishes a WebSocket connection to a server (or lures a victim's client to connect to an attacker-controlled endpoint) where the application closes connections by calling close() with a TypedArray reason. When the close frame is sent, the attacker reads the reason payload and recovers fragments of uninitialized Node.js process heap, potentially exposing session tokens or other clients' data. No public exploit code is identified at time of analysis, and the network attack complexity is low once the vulnerable close() pattern is in use.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv5 – Jun 30, 2026

Uninitialized memory disclosure in the ws WebSocket library for Node.js (versions 8.0.0 through 8.20.0) allows a connected peer to receive leaked process memory when an application calls websocket.close() with a TypedArray as the reason argument. Because the close-frame reason buffer is not zero-initialized, fragments of adjacent heap memory - potentially containing secrets, tokens, or other clients' data - are transmitted over the wire. No public exploit is identified at time of analysis (SSVC lists POC-class maturity but EPSS is only 0.01%), and the issue is fixed in ws 8.20.1.

Earlier versions of this analysis (4)
v4 Jun 30, 2026 - 04:19 cvss changed CVSS 7.5

Uninitialized memory disclosure in the ws WebSocket library for Node.js (versions 8.0.0 through 8.20.0) lets a remote peer receive leftover process heap contents when an application calls websocket.close() with a TypedArray as the reason argument, because the buffer backing the close frame is not zero-filled before transmission. Fixed in 8.20.1, the flaw can expose sensitive in-process data (keys, tokens, other clients' data) to the connection peer. Rated CVSS 7.5 (C:H), this carries a very low EPSS (0.01%) and SSVC marks exploitation as proof-of-concept only and not automatable; publicly available exploit reasoning exists via the GitHub advisory but it is not on CISA KEV.

v3 Jun 30, 2026 - 04:19 cvss changed CVSS 7.5

Uninitialized memory disclosure in the ws WebSocket library for Node.js (versions 8.0.0 through 8.20.0) lets the remote peer receive leaked heap contents when an application calls websocket.close() with a TypedArray as the reason argument. Unauthenticated remote peers on the receiving end of the close frame can obtain fragments of process memory that may include sensitive data such as tokens, keys, or other buffer contents. Publicly available exploit code exists (SSVC: PoC), but EPSS is very low (0.01%) and it is not on CISA KEV, indicating no observed in-the-wild exploitation.

v2 Jun 30, 2026 - 04:16 cvss changed CVSS 7.5

Uninitialized memory disclosure in the ws WebSocket library for Node.js (versions 8.0.0 through before 8.20.1) occurs when a TypedArray is passed as the reason argument to websocket.close(), causing leftover heap memory to be transmitted in the close frame. Remote peers can therefore receive fragments of process memory that may contain secrets, keys, or other sensitive data. EPSS is very low (0.01%), the issue is not in CISA KEV, and SSVC marks exploitation as proof-of-concept with partial technical impact; no public exploit was identified at time of analysis.

v1 May 15, 2026 - 15:30 CVSS 4.4

Uninitialized memory disclosure in ws Node.js WebSocket library versions prior to 8.20.1 allows authenticated remote attackers with high privileges to extract server memory contents. Exploitation occurs when a TypedArray (other than Uint8Array) is passed to websocket.close() as the reason argument, causing the library to read and transmit uninitialized memory buffers. EPSS score not provided; no public exploit identified at time of analysis, but fix commit publicly available on GitHub.

RemediationAI

Vendor-released patch: ws 8.20.1 - upgrade the ws dependency (including transitive copies pulled in by frameworks such as Socket.IO) to 8.20.1 or later, then audit your lockfile to ensure no nested older copies remain. Red Hat consumers should apply the corresponding errata (RHSA-2026:7655, RHSA-2026:26638, RHSA-2026:26994, RHSA-2026:27171, RHSA-2026:29197) via the platform package manager; see https://access.redhat.com/errata/RHSA-2026:29197 and the advisory at https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx. If you cannot upgrade immediately, a targeted compensating control is to ensure application code never passes a TypedArray (e.g., Uint8Array) to websocket.close() - instead pass the reason as a string or omit it - which avoids the vulnerable allocation path entirely; the trade-off is a code change in every place that closes a socket with a binary reason, but it has no protocol-level side effects since string reasons are fully supported by RFC 6455. The upstream fix commit is https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086.

Affected VersionsENISA

ws 8.0.0, < 8.20.1

Affected Packages

npm ws fix: 8.20.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

ws is one of the most widely used WebSocket client/server implementations in the Node.js ecosystem, shipped as a transitive dependency of countless frameworks (Socket.IO, express-ws, etc.). The flaw is rooted in CWE-908 (Use of Uninitialized Resource): when websocket.close(code, reason) is invoked with a TypedArray reason, ws allocates a buffer for the close-frame payload without fully initializing it, so previously-freed or never-written heap bytes are copied into the outbound frame. The affected component is identified by CPE cpe:2.3:a:ws_project:ws for the node.js target. The control frame's reason field is then sent to the remote peer per RFC 6455, turning an internal memory-handling bug into a network-observable information leak.

Know when Ws gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI 7.5 HIGH

Network-reachable and unauthenticated, but AC:H because it requires the app to use a TypedArray close reason, and C:L since only opportunistic uninitialized heap leaks.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE 4.4 MEDIUM
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Red Hat 7.5 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

7
Analysis Updated
Jun 30, 2026 - 04:20 vuln.today
v5 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:19 vuln.today
v4 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:19 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:16 vuln.today
v2 - CVSS changed
Severity Changed
Jun 30, 2026 - 03:24 NVD
MEDIUM HIGH
CVSS changed
Jun 30, 2026 - 03:24 NVD
4.4 (MEDIUM) 7.5 (HIGH)
Patch available
May 15, 2026 - 16:01 EUVD

DescriptionNVD

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 31 npm packages depend on ws (21 direct, 11 indirect)

Ecosystem-wide dependent count for version 8.0.0.

Executive ViewAI

Why It Matters

The ws WebSocket library for Node.js (versions 8.0.0-8.20.0) contains a memory disclosure vulnerability that leaks process memory-potentially containing credentials, API tokens, and other clients' session data-to connected WebSocket peers. Any organization running Node.js applications with this library version risks confidential information exposure through normal WebSocket close operations.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 99% exploitable
Prevalence
Ubiquitous
ws is the de facto WebSocket library across the Node.js ecosystem
Threat Intel
1
1 sources
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
Poc
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Ws

View all
CVE-2021-32640 MEDIUM POC
5.3 May 25

ws is an open source WebSocket client and server library for Node.js. Rated medium severity (CVSS 5.3), this vulnerabili
CVE-2026-62389 HIGH
8.7 Jul 15

Denial of service in the ws WebSocket library for Node.js (versions before 8.21.1) allows remote unauthenticated attacke

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:26638 ADVISORY https://access.redhat.com/errata/RHSA-2026:26994 ADVISORY https://access.redhat.com/errata/RHSA-2026:27171 ADVISORY https://access.redhat.com/errata/RHSA-2026:29197 ADVISORY https://access.redhat.com/errata/RHSA-2026:7655 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-45736 ADVISORY https://vuldb.com/vuln/364180 REF https://access.redhat.com/errata/RHSA-2026:33574 REF https://access.redhat.com/errata/RHSA-2026:34374 REF https://access.redhat.com/errata/RHSA-2026:36754 REF https://access.redhat.com/errata/RHSA-2026:36820 REF https://access.redhat.com/errata/RHSA-2026:37272 REF https://access.redhat.com/errata/RHSA-2026:40768 REF https://access.redhat.com/errata/RHSA-2026:40792 REF https://access.redhat.com/errata/RHSA-2026:41928 REF https://access.redhat.com/errata/RHSA-2026:44235 REF https://access.redhat.com/errata/RHSA-2026:44263 REF https://access.redhat.com/errata/RHSA-2026:44267 REF https://access.redhat.com/errata/RHSA-2026:48151 REF https://access.redhat.com/errata/RHSA-2026:48693 REF https://access.redhat.com/errata/RHSA-2026:56366 REF https://access.redhat.com/errata/RHSA-2026:56431 REF https://access.redhat.com/errata/RHSA-2026:56928 REF https://access.redhat.com/errata/RHSA-2026:57013 REF https://access.redhat.com/errata/RHSA-2026:57590 REF https://access.redhat.com/errata/RHSA-2026:60520 REF https://access.redhat.com/errata/RHSA-2026:65126 REF https://access.redhat.com/errata/RHSA-2026:66488 REF https://access.redhat.com/errata/RHSA-2026:66545 REF https://access.redhat.com/security/cve/CVE-2026-45736 REF https://bugzilla.redhat.com/show_bug.cgi?id=2477914 REF https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086 REF https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45736.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy