ws EUVD-2026-44729

Exploitation requires only that the target run a ws server (version before 8.21.1) that accepts WebSocket connections and permits fragmented data messages - the default configuration, since the pre-patch defaults for maxFragments/maxBufferedChunks were high enough to allow substantial accumulation. The concrete trigger is a data message begun with a text frame carrying FIN=0 followed by continuation frames (including empty fragments) that never complete the sequence, per the description. No authentication, no user interaction, and no special platform are needed (PR:N/UI:N/AV:N). Limiting factors: the target endpoint must be network-reachable by the attacker, and deployments that already set a low custom maxFragments, terminate incomplete/idle WebSocket sessions at a proxy, or restrict WebSocket access to authenticated internal users substantially reduce exposure.

This is a genuine availability risk but strictly a denial-of-service issue - the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VA:H and VC/VI:N confirms a network-reachable, no-authentication, low-complexity attack that impacts only availability, consistent with the CWE-770 classification. The 8.7 CVSS 4.0 base is High, driven entirely by the high availability impact plus the trivial network preconditions. No EPSS score and no KEV listing were provided, and there is no indication of a public proof-of-concept, so despite the low exploitation barrier this should be treated as a plausible-but-not-yet-observed threat rather than an actively exploited one; the absence of EPSS data means widespread-exploitation probability cannot be quantified from the input. There is no confidentiality or integrity exposure, so this is a resource-availability priority - high value for internet-facing WebSocket services, lower urgency for internal or authenticated-only endpoints. The signals are internally consistent (network DoS, no privilege needed), so there is no CVSS-versus-description conflict to flag.

An attacker opens a WebSocket connection to an internet-facing Node.js service running a pre-8.21.1 ws server, sends a text frame with FIN=0, and then streams a long series of continuation frames (including empty ones) without ever sending a final frame. Because each fragment is buffered as a separate Buffer and the count guard never trips, the server's heap grows until the Node process is killed by the out-of-memory handler; repeating this across a few connections amplifies the effect. No authentication or user interaction is required, and while no public POC is identified, the attack is straightforward to script against a raw WebSocket client.