CVE-2026-45736

MediumCVSS 4.4

Published: 15/05/2026(UTC)Updated: 28/08/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.75%

52th percentile - higher than 52% of all known CVEs

Summary

The 'ws' WebSocket library for Node.js prior to 8.20.1 has a vulnerability that discloses uninitialized memory when closing a connection with a TypedArray as the reason argument.

Risk Assessment

An attacker can read server memory fragments, potentially exposing sensitive data.

Recommendation

Update the 'ws' library to version 8.20.1 or later.

Other vulnerabilities in ws

CVE-2026-48779High
The 'ws' WebSocket library for Node.js is vulnerable to a memory exhaustion DoS attack. An attacker can send a high volume of very small data fragments, forcing the server to allocate wrapper structures that consume far more memory than the default message-size limit, leading to process termination due to OOM.

Original NVD description (English source)

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.