ws: Uninitialized memory disclosure

Description

The websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.

Recommendation

Update the ws package to the latest compatible version. Followings are version details:

• Affected version(s): >= 8.0.0, < 8.20.1
• Patched version(s): 8.20.1

References

• GHSA-58qx-3vcg-4xpx
• CVE-2026-45736
• CWE-908
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Remote Memory Disclosure in ws - CVE-2016-10518
• ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictio - CVE-2026-39857
• Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands - CVE-2026-29772
• Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression - CVE-2026-1526

You might also like:

Exploiting Server Version Disclosure

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

ws