Log in Start free

Vulnerability · Published May 15, 2026 · Assigned by GitHub_M

CVE-2026-45736ws: Uninitialized memory disclosure

Medium 4.4

In plain English

A medium-severity security flaw in ws from websockets. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.7%top 45.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-wsno fix listedDEBIAN-CVE-2026-45736
Debian:13node-wsno fix listedDEBIAN-CVE-2026-45736
Debian:14node-ws8.20.1+~cs14.19.1-1DEBIAN-CVE-2026-45736
Ubuntu:22.04:LTSnode-wsno fix listedUBUNTU-CVE-2026-45736
Ubuntu:24.04:LTSnode-wsno fix listedUBUNTU-CVE-2026-45736
Ubuntu:25.10node-wsno fix listedUBUNTU-CVE-2026-45736
Ubuntu:26.04:LTSnode-wsno fix listedUBUNTU-CVE-2026-45736
Ubuntu:26.10node-wsno fix listedUBUNTU-CVE-2026-45736
npmws8.20.1GHSA-58qx-3vcg-4xpx

Affected products (as reported)

VendorProductVersions
websockets ws >= 8.0.0, < 8.20.1

Weakness: CWE-908, CWE-824 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

References