7.5
High
CVE-2026-48779 ws is an open source WebSocket client and server for Node.js
Description
ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ws 8.0 | 8.0.0 → < 8.21.0 | 8.21.0 |
| ws 7.0 | 7.0.0 → < 7.5.11 | 7.5.11 |
| ws 6.0 | 6.0.0 → < 6.2.4 | 6.2.4 |
| ws 1.1 | 1.1.0 → < 5.2.5 | 5.2.5 |
| Red Hat Discovery 2 1782166952 | earliest → < 1782166952 | 1782166952 |
| Red Hat OpenShift Service Mesh 2.6 1782287580 | earliest → < 1782287580 | 1782287580 |
| Red Hat OpenShift Service Mesh 3.0 1782201833 | earliest → < 1782201833 | 1782201833 |
| Red Hat OpenShift Service Mesh 3.1 1782201537 | earliest → < 1782201537 | 1782201537 |
| Red Hat OpenShift Service Mesh 3.2 1782201812 | earliest → < 1782201812 | 1782201812 |
Show the 56 other branches Hide the 56 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Service Mesh 3.3 1782201466 | earliest → < 1782201466 | 1782201466 |
| Cryostat 4 | Versions not published | |
| Gatekeeper 3 | Versions not published | |
| Migration Toolkit for Containers | Versions not published | |
| Node HealthCheck Operator | Versions not published | |
| OpenShift Lightspeed | Versions not published | |
| OpenShift Pipelines | Versions not published | |
| Red Hat AMQ Broker 7 | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat build of Apache Camel - HawtIO 4 | Versions not published | |
| Red Hat Build of Podman Desktop | Versions not published | |
| Red Hat Build of Podman Desktop - Tech Preview | Versions not published | |
| Red Hat Connectivity Link 1 | Versions not published | |
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat Developer Hub | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat Hardened Images | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat Openshift Data Foundation 4 | Versions not published | |
| Red Hat OpenShift Dev Spaces | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat Quay 3 | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Red Hat Trusted Artifact Signer | Versions not published | |
| Self-service automation portal 2 | Versions not published | |
| OpenShift Service Mesh 3 | Versions not published | |
| Red Hat build of Apache Camel for Spring Boot 4 | Versions not published | |
| Red Hat Build of Keycloak | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat Developer Hub 1.9 1782761244 | earliest → < 1782761244 | 1782761244 |
| Cluster Observability Operator 1.5.0 1782839494 | earliest → < 1782839494 | 1782839494 |
| Red Hat Developer Hub 1.10 1783448184 | earliest → < 1783448184 | 1783448184 |
| Red Hat OpenShift Dev Spaces 3.29 1782498792 | earliest → < 1782498792 | 1782498792 |
| Red Hat OpenShift Service Mesh 3 1782201833 | earliest → < 1782201833 | 1782201833 |
| Red Hat Trusted Artifact Signer 1.4 1783327185 | earliest → < 1783327185 | 1783327185 |
| Red Hat Openshift Data Foundation 4.20 1786629548 | earliest → < 1786629548 | 1786629548 |
| Red Hat Openshift Data Foundation 4.20 1783669219 | earliest → < 1783669219 | 1783669219 |
| Red Hat Openshift Data Foundation 4.2 1786629548 | earliest → < 1786629548 | 1786629548 |
| Red Hat Openshift Data Foundation 4.2 1783669219 | earliest → < 1783669219 | 1783669219 |
| Red Hat Migration Toolkit 1.8 1783690532 | earliest → < 1783690532 | 1783690532 |
| Red Hat Openshift Data Foundation 4.18 1786706880 | earliest → < 1786706880 | 1786706880 |
| Red Hat Openshift Data Foundation 4.18 1783677533 | earliest → < 1783677533 | 1783677533 |
| Red Hat Openshift Data Foundation 4.19 1786703143 | earliest → < 1786703143 | 1786703143 |
| Red Hat Openshift Data Foundation 4.19 1783685375 | earliest → < 1783685375 | 1783685375 |
| Cryostat 4 on RHEL 9 4.2 | earliest → < 4.2.0-13 | 4.2.0-13 |
| Red Hat OpenShift AI 3.4 1787121387 | earliest → < 1787121387 | 1787121387 |
| Cluster Observability Operator 1.5.2 1782839494 | earliest → < 1782839494 | 1782839494 |
| Red Hat OpenShift AI 2.25 1787801527 | earliest → < 1787801527 | 1787801527 |
| Red Hat AMQ Broker 7.13.6 | Versions not published | |
| Red Hat AMQ Broker 7.14.1 | Versions not published |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of ws
The 5 CVEs of ws →
CVE-2026-62389
ws before 8.21.1 contains a memory exhaustion vulnerability in lib/receiver.js where the fragment guard only triggers…
8.7
High
CVE-2026-45736
ws is an open source WebSocket client and server for Node.js
4.4
Medium
CVE-2024-37890
ws is an open source WebSocket client and server for Node.js
7.5
High
CVE-2021-32640
ws is an open source WebSocket client and server library for Node.js
5.3
Medium