PT-2026-49552 · Npm+1 · Ws

Published 2026-06-15 · Updated 2026-06-16 · CVE-2026-48779

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ws versions 1.1.0 through 5.2.4 ws versions 6.0.0 through 6.2.3 ws versions 7.0.0 through 7.5.10 ws versions 8.0.0 through 8.20.9

Description ws is an open source WebSocket client and server for Node.js. A peer can send a high volume of exceptionally small fragments and data chunks using modest network traffic to force the remote peer to allocate and hold structural wrappers. These wrappers consume significantly more memory than the default documented message-size limit, which can lead to process termination due to Out of Memory (OOM), a state where the system cannot allocate more memory to a process. This results in a memory exhaustion Denial of Service (DoS).

Recommendations Update versions 1.1.0 through 5.2.4 to 5.2.5. Update versions 6.0.0 through 6.2.3 to 6.2.4. Update versions 7.0.0 through 7.5.10 to 7.5.11. Update versions 8.0.0 through 8.20.9 to 8.21.0. As a mitigation measure, lower the value of the maxPayload option.

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2026-48779

GHSA-96HV-2XVQ-FX4P

Affected Products

Ws

References · 7

• https://osv.dev/vulnerability/GHSA-96hv-2xvq-fx4p · Vendor Advisory
• https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8 · Note
• https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p · Note
• https://github.com/websockets/ws · Note
• https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94 · Note
• https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7 · Note
• https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53 · Note