websocket-driver EUVD-2026-45335

The exploit requires that the server accept and parse WebSocket frames using the draft-version framing implemented in draft75.js, where the length header is an open-ended sequence of high-bit-set continuation bytes - an attacker sends an indefinite stream of bytes >= 0x80 to inflate the length integer past JavaScript's 53-bit safe-integer precision. Per the CVSS vector (AV:N/PR:N/UI:N), no authentication or user interaction is needed and it works remotely over the network against a reachable WebSocket endpoint. Limiting factors: the target must be running websocket-driver < 0.7.5 and must negotiate/accept the vulnerable draft protocol path (deployments restricted to finalized RFC 6455 framing are less exposed), and the practical effect is message corruption/desync rather than compromise of confidentiality or availability.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 9.2 and captures a genuinely low-barrier, remote, unauthenticated, no-interaction trigger - consistent with the description. However, impact is integrity-only (VI:H/SI:H, with VC:N/VA:N), meaning this is message corruption/desync rather than RCE or data theft, so the 9.2 overstates real-world severity for most operators who are not relying on frame integrity for a security boundary. There is no EPSS score, no POC, and no KEV listing provided, so exploitation is theoretical at present; the attack also depends on the server negotiating a vulnerable draft protocol version rather than the finalized RFC 6455 framing, which limits exposure on modern deployments. The input's 'Information Disclosure' tag conflicts with the CVSS impact metrics, which show no confidentiality impact (VC:N) - the tag appears mislabeled; treat this as an integrity/data-corruption issue, not disclosure. Net: patch-worthy given trivial reachability and broad transitive deployment, but a lower operational priority than a comparable 9.2 with confidentiality or availability impact.

A remote unauthenticated attacker opens a WebSocket connection to a server using a vulnerable websocket-driver version and, during a draft-protocol frame, streams a long run of continuation bytes (values >= 0x80) so the accumulated length integer grows past 2^53 and loses precision. The server then misparses the following bytes as a new frame, letting the attacker corrupt message boundaries or smuggle payload content into an adjacent message. No POC is provided, but the low complexity (AC:L) and lack of auth/interaction make the trigger straightforward to script.