CVE-2026-45736
ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.
Faiblesse
ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.
Produits concernés
- ws_project ws
Références
- https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086
- https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx
- https://access.redhat.com/errata/RHSA-2026:26638
- https://access.redhat.com/errata/RHSA-2026:26994
- https://access.redhat.com/errata/RHSA-2026:27171
- https://access.redhat.com/errata/RHSA-2026:29197
Trouvez la faille avant un attaquant.
Connectez-vous avec GitHub et lancez votre premier audit en moins d'une minute. L'offre gratuite ne nécessite aucune carte bancaire.