ws: Uninitialized memory disclosure

Description

The websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.

Recommendation

Update the ws package to the latest compatible version. Followings are version details:

• Affected version(s): >= 8.0.0, < 8.20.1
• Patched version(s): 8.20.1

References

• GHSA-58qx-3vcg-4xpx
• CVE-2026-45736
• CWE-908
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Remote Memory Disclosure in ws - CVE-2016-10518
• devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse - CVE-2026-22775
• LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting sid - CVE-2026-39412
• Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse - CVE-2026-22774

You might also like:

Exploiting Server Version Disclosure

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

ws