NexaPulse
Subscribe
4.4mediumMedium

CVE-2026-45736

Ws Project Ws

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

Exploitation status

  • Published references include exploit or proof-of-concept material. There is no confirmation it is being used in real attacks.
  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is reachable over a network, without needing local access.
  • For an attacker who can reach it, exploitation depends on conditions outside the attacker's control.
  • To exploit it, an administrative account is needed.
  • Beyond that, no action by a user is required.

Scoring

CVSS
4.4 (v3.1)
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-908
Assigned by
security-advisories@github.com

Dates

Published
2026-05-15
Last modified
2026-08-28
Sources
NVD

Affected products

  • Ws Project Ws8.0.0 - 8.20.1

As listed in the NVD configuration data. Not a statement about your estate.

References