8.7
High
CVE-2026-62389 ws before 8.21.1 contains a memory exhaustion vulnerability in lib/receiver.js where the fragment guard only triggers…
Description
ws before 8.21.1 contains a memory exhaustion vulnerability in lib/receiver.js where the fragment guard only triggers when fragment count reaches maxFragments, allowing attackers to exhaust memory by sending incomplete fragmented WebSocket messages. Attackers can send a text frame with FIN=0 followed by continuation frames without completing the sequence, causing each fragment to be stored as a separate Buffer object with significant overhead, enabling denial of service through heap exhaustion.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ws 8.21 | earliest → < 8.21.1 | 8.21.1 |
References
- Researcher Disclosure github.com
- Release Notes github.com
- Patch Commit github.com
- www.vulncheck.com www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of ws
The 5 CVEs of ws →
CVE-2026-48779
ws is an open source WebSocket client and server for Node.js
7.5
High
CVE-2026-45736
ws is an open source WebSocket client and server for Node.js
4.4
Medium
CVE-2024-37890
ws is an open source WebSocket client and server for Node.js
7.5
High
CVE-2021-32640
ws is an open source WebSocket client and server library for Node.js
5.3
Medium