Description
ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| websockets | ws | >= 1.1.0, < 5.2.5; >= 6.0.0, < 6.2.4; >= 7.0.0, < 7.5.11; >= 8.0.0, < 8.21.0 |
| Red Hat | Cryostat 4 on RHEL 9 | — |
| Red Hat | Red Hat AMQ Broker 7.13.6 | — |
| Red Hat | Red Hat AMQ Broker 7.14.1 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Cluster Observability Operator 1.5.0 | — |
| Red Hat | Cluster Observability Operator 1.5.0 | — |
| Red Hat | Cluster Observability Operator 1.5.0 | — |
| Red Hat | Cluster Observability Operator 1.5.0 | — |
| Red Hat | Cluster Observability Operator 1.5.0 | — |
| Red Hat | Cluster Observability Operator 1.5.0 | — |
| Red Hat | Cluster Observability Operator 1.5.0 | — |
| Red Hat | Cluster Observability Operator 1.5.0 | — |
| Red Hat | Cluster Observability Operator 1.5.0 | — |
| Red Hat | Cluster Observability Operator 1.5.0 | — |
| Red Hat | Cluster Observability Operator 1.5.0 | — |
| Red Hat | Cluster Observability Operator 1.5.0 | — |
| Red Hat | Red Hat Developer Hub 1.10 | — |
| Red Hat | Red Hat Developer Hub 1.9 | — |
| Red Hat | Red Hat Discovery 2 | — |
| Red Hat | Red Hat Migration Toolkit 1.8 | — |
| Red Hat | Red Hat OpenShift AI 2.25 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.19 | — |
| Red Hat | Red Hat Openshift Data Foundation 4.19 | — |
References
- https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7Patch
- https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53Patch
- https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94Patch
- https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8Patch
- https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4pExploit, Mitigation, Patch, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:29197
- https://access.redhat.com/errata/RHSA-2026:33155
- https://access.redhat.com/errata/RHSA-2026:33160
- https://access.redhat.com/errata/RHSA-2026:33163
- https://access.redhat.com/errata/RHSA-2026:33173
- https://access.redhat.com/errata/RHSA-2026:33183
- https://access.redhat.com/errata/RHSA-2026:33574
- https://access.redhat.com/errata/RHSA-2026:34342
- https://access.redhat.com/errata/RHSA-2026:36754
- https://access.redhat.com/errata/RHSA-2026:36820
- https://access.redhat.com/errata/RHSA-2026:37272
- https://access.redhat.com/errata/RHSA-2026:40984
- https://access.redhat.com/errata/RHSA-2026:41928
- https://access.redhat.com/errata/RHSA-2026:41941
- https://access.redhat.com/errata/RHSA-2026:41944
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:56366
- https://access.redhat.com/errata/RHSA-2026:56431
- https://access.redhat.com/errata/RHSA-2026:57013
- https://access.redhat.com/errata/RHSA-2026:57590
- https://access.redhat.com/errata/RHSA-2026:60520
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/errata/RHSA-2026:66488
- https://access.redhat.com/errata/RHSA-2026:66545
- https://access.redhat.com/security/cve/CVE-2026-48779
- https://bugzilla.redhat.com/show_bug.cgi?id=2489661
- https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4pExploit, Mitigation, Patch, Vendor Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json
Timeline
- Published
- Jun 17, 2026
- Last modified
- Oct 26, 2026
- NVD status
- Modified