4.4
Medium
CVE-2026-45736 ws is an open source WebSocket client and server for Node.js
Description
ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ws 8.0 | 8.0.0 → < 8.20.1 | 8.20.1 |
| Red Hat Discovery 2 1782166952 | earliest → < 1782166952 | 1782166952 |
| Red Hat Hardened Images | Versions not published | |
| Cryostat 4 | Versions not published | |
| Gatekeeper 3 | Versions not published | |
| Migration Toolkit for Containers | Versions not published | |
| Node HealthCheck Operator | Versions not published | |
| OpenShift Lightspeed | Versions not published | |
| OpenShift Pipelines | Versions not published |
Show the 49 other branches Hide the 49 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat AMQ Broker 7 | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat build of Apache Camel - HawtIO 4 | Versions not published | |
| Red Hat Build of Keycloak | Versions not published | |
| Red Hat Build of Podman Desktop | Versions not published | |
| Red Hat Build of Podman Desktop - Tech Preview | Versions not published | |
| Red Hat Connectivity Link 1 | Versions not published | |
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat Developer Hub | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat Openshift Data Foundation 4 | Versions not published | |
| Red Hat OpenShift Dev Spaces | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat Quay 3 | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Red Hat Trusted Artifact Signer | Versions not published | |
| Self-service automation portal 2 | Versions not published | |
| OpenShift Service Mesh 2 | Versions not published | |
| OpenShift Service Mesh 3 | Versions not published | |
| Red Hat build of Apache Camel for Spring Boot 4 | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat Developer Hub 1.9 1782761244 | earliest → < 1782761244 | 1782761244 |
| Red Hat Ansible Automation Platform 2.6 1782761510 | earliest → < 1782761510 | 1782761510 |
| Red Hat Developer Hub 1.10 1783448184 | earliest → < 1783448184 | 1783448184 |
| Red Hat OpenShift Dev Spaces 3.29 1782498792 | earliest → < 1782498792 | 1782498792 |
| Red Hat Trusted Artifact Signer 1.4 1783327185 | earliest → < 1783327185 | 1783327185 |
| Red Hat Migration Toolkit 1.8 1783690532 | earliest → < 1783690532 | 1783690532 |
| Red Hat OpenShift Container Platform 4.21 1784713741 | earliest → < 1784713741 | 1784713741 |
| Red Hat OpenShift Container Platform 4.22 1785230147 | earliest → < 1785230147 | 1785230147 |
| Red Hat OpenShift Container Platform 4.20 1784730857 | earliest → < 1784730857 | 1784730857 |
| Cryostat 4 on RHEL 9 4.2 | earliest → < 4.2.0-13 | 4.2.0-13 |
| Red Hat OpenShift Container Platform 4.19 1784670101 | earliest → < 1784670101 | 1784670101 |
| Red Hat OpenShift Container Platform 4.2 1784730857 | earliest → < 1784730857 | 1784730857 |
| Red Hat OpenShift AI 3.4 1787121387 | earliest → < 1787121387 | 1787121387 |
| Red Hat Openshift Data Foundation 4.18 1786706880 | earliest → < 1786706880 | 1786706880 |
| Red Hat Openshift Data Foundation 4.19 1786703143 | earliest → < 1786703143 | 1786703143 |
| Red Hat Openshift Data Foundation 4.2 1786629548 | earliest → < 1786629548 | 1786629548 |
| Red Hat Openshift Data Foundation 4.22 1787061554 | earliest → < 1787061554 | 1787061554 |
| Red Hat OpenShift AI 2.25 1787801527 | earliest → < 1787801527 | 1787801527 |
| Red Hat Openshift Data Foundation 4.20 1786629548 | earliest → < 1786629548 | 1786629548 |
| Red Hat AMQ Broker 7.13.6 | Versions not published | |
| Red Hat AMQ Broker 7.14.1 | Versions not published |
References
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of ws
The 5 CVEs of ws →
CVE-2026-62389
ws before 8.21.1 contains a memory exhaustion vulnerability in lib/receiver.js where the fragment guard only triggers…
8.7
High
CVE-2026-48779
ws is an open source WebSocket client and server for Node.js
7.5
High
CVE-2024-37890
ws is an open source WebSocket client and server for Node.js
7.5
High
CVE-2021-32640
ws is an open source WebSocket client and server library for Node.js
5.3
Medium