websocket-driver: Message corruption via abuse of protocol length headers

Description

The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer.

Recommendation

Update the websocket-driver package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.7.5
• Patched version(s): 0.7.5

References

• GHSA-xv26-6w52-cph6
• CVE-2026-54466
• CWE-130
• CAPEC-310
• OWASP 2021-A6

Related Issues

• websocket-driver: Resource limit bypass via message compression - CVE-2026-54490
• @siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection - CVE-2026-31975
• Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter - CVE-2026-29793
• Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check - CVE-2026-31860

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

websocket-driver