CVE-2026-45736

MEDIUM 4.4

ws: Uninitialized memory disclosure

CVSS Score

4.4

EPSS Score

0.0%

EPSS Percentile

0th

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

CWE	CWE-908
Vendor	websockets
Product	ws
Published	May 15, 2026
Last Updated	Aug 12, 2026

Stay Ahead of the Next One

Get instant alerts for websockets ws

Be the first to know when new medium vulnerabilities affecting websockets ws are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

websockets / ws

>= 8.0.0, < 8.20.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx github.com: https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-45736 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2477914 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45736.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:48151 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34374 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36754 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33574 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:29197 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:26638 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:26994 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:27171 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7655 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41928 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:44235 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:44263 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:44267 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40792 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:48693 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40768 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36820 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:37272