CVE-2026-45736
ws: Uninitialized memory disclosure
- State
- Published
- Severity
- 4.4 Medium
- Published
- May 15, 2026
- Updated
- Sep 11, 2026
- Reserved
- May 13, 2026
Description
ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.4 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N | GitHub_M |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | redhat-SADP |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
wswebsockets |
|
References
- https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx
- https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086
- https://access.redhat.com/security/cve/CVE-2026-45736vdb-entry
- RHBZ#2477914issue-tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45736.json
- https://access.redhat.com/errata/RHSA-2026:48151vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:57590vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:66545vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:66488vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:34374vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:36754vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:33574vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:29197vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:26638vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:26994vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:27171vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:7655vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:41928vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:65126vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:60520vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:44235vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:44263vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:44267vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:40792vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:48693vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:40768vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:36820vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:56431vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:56366vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:57013vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:56928vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:37272vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.