CVE-2026-45736

Published May 15th, 2026

View on NVD ↗

CVSS v3

4.4

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

websockets/ws

Simple to use, blazing fast and thoroughly tested WebSocket client and server for Node.js

GitHub

22.8K