PT-2026-41307 · Npm+1 · Ws+1

Osidb Bzimport · Published 2026-05-12 · Updated 2026-07-10 · CVE-2026-45736

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ws versions prior to 8.20.1

Description ws is an open source WebSocket client and server for Node.js. The websocket.close() function is susceptible to uninitialized memory disclosure, which occurs when a TypedArray is provided as the reason argument.

Recommendations Update to version 8.20.1.

Exploit

Fix

DoS

Use of Uninitialized Resource

Access of Uninitialized Pointer

Weakness Enumeration

CWE-908

CWE-824

Related Identifiers

BDU:2026-09331

CVE-2026-45736

GHSA-58QX-3VCG-4XPX

RHSA-2026:27171

RHSA-2026:7655

Affected Products

Confluence

Ws

References · 37

• 🔥 https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45736.json · Exploit
• https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086 · Patch
• https://access.redhat.com/errata/RHSA-2026:36820 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-45736 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:34374 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-45736 · Security Note
• https://access.redhat.com/errata/RHSA-2026:26994 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45736 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45736 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:36754 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45736 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:27171 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45736 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:26638 · Vendor Advisory