DoS Vulnerability in WebSocket Client and Server by ws
CVE-2026-48779
7.5HIGH
What is CVE-2026-48779?
The ws library, a widely used open-source WebSocket client and server framework for Node.js, has a vulnerability that allows an attacker to exploit memory exhaustion through sending an overwhelming number of small data fragments. This overload can lead to significant memory consumption, causing the server to terminate due to out-of-memory (OOM) errors. The issue has been remedied in the latest versions, specifically 5.2.5, 6.2.4, 7.5.11, and 8.21.0, ensuring that applications utilizing the ws library are safeguarded from this potential denial-of-service threat.
Affected Version(s)
ws >= 1.1.0, < 5.2.5 < 1.1.0, 5.2.5
ws >= 6.0.0, < 6.2.4 < 6.0.0, 6.2.4
ws >= 7.0.0, < 7.5.11 < 7.0.0, 7.5.11