8.7
Élevée
CVE-2026-62389 ws before 8.21.1 contains a memory exhaustion vulnerability in lib/receiver.js where the fragment guard only triggers…
Description
ws before 8.21.1 contains a memory exhaustion vulnerability in lib/receiver.js where the fragment guard only triggers when fragment count reaches maxFragments, allowing attackers to exhaust memory by sending incomplete fragmented WebSocket messages. Attackers can send a text frame with FIN=0 followed by continuation frames without completing the sequence, causing each fragment to be stored as a separate Buffer object with significant overhead, enabling denial of service through heap exhaustion.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| ws 8.21 | premières → < 8.21.1 | 8.21.1 |
Références
- Researcher Disclosure github.com
- Release Notes github.com
- Patch Commit github.com
- www.vulncheck.com www.vulncheck.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de ws
Les 5 CVE de ws →
CVE-2026-48779
ws is an open source WebSocket client and server for Node.js
7.5
Élevée
CVE-2026-45736
ws is an open source WebSocket client and server for Node.js
4.4
Moyenne
CVE-2024-37890
ws is an open source WebSocket client and server for Node.js
7.5
Élevée
CVE-2021-32640
ws is an open source WebSocket client and server library for Node.js
5.3
Moyenne