Vulnerability Details CVE-2026-45736
ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 52.6%
CVSS Severity
CVSS v3 Score 4.4
References
- https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086
- https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx
- https://access.redhat.com/errata/RHSA-2026:26638
- https://access.redhat.com/errata/RHSA-2026:26994
- https://access.redhat.com/errata/RHSA-2026:27171
- https://access.redhat.com/errata/RHSA-2026:29197
- https://access.redhat.com/errata/RHSA-2026:33574
- https://access.redhat.com/errata/RHSA-2026:34374
- https://access.redhat.com/errata/RHSA-2026:36754
- https://access.redhat.com/errata/RHSA-2026:36820
- https://access.redhat.com/errata/RHSA-2026:37272
- https://access.redhat.com/errata/RHSA-2026:40768
- https://access.redhat.com/errata/RHSA-2026:40792
- https://access.redhat.com/errata/RHSA-2026:41928
- https://access.redhat.com/errata/RHSA-2026:44235
- https://access.redhat.com/errata/RHSA-2026:44263
- https://access.redhat.com/errata/RHSA-2026:44267
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:48693
- https://access.redhat.com/errata/RHSA-2026:56366
- https://access.redhat.com/errata/RHSA-2026:56431
- https://access.redhat.com/errata/RHSA-2026:56928
- https://access.redhat.com/errata/RHSA-2026:57013
- https://access.redhat.com/errata/RHSA-2026:57590
- https://access.redhat.com/errata/RHSA-2026:60520
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/errata/RHSA-2026:7655
- https://access.redhat.com/security/cve/CVE-2026-45736
- https://bugzilla.redhat.com/show_bug.cgi?id=2477914
- https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45736.json
Products affected by CVE-2026-45736
-
cpe:2.3:a:ws_project:ws:8.0.0
-
cpe:2.3:a:ws_project:ws:8.1.0
-
cpe:2.3:a:ws_project:ws:8.10.0
-
cpe:2.3:a:ws_project:ws:8.11.0
-
cpe:2.3:a:ws_project:ws:8.12.0
-
cpe:2.3:a:ws_project:ws:8.12.1
-
cpe:2.3:a:ws_project:ws:8.13.0
-
cpe:2.3:a:ws_project:ws:8.14.0
-
cpe:2.3:a:ws_project:ws:8.14.1
-
cpe:2.3:a:ws_project:ws:8.14.2
-
cpe:2.3:a:ws_project:ws:8.15.0
-
cpe:2.3:a:ws_project:ws:8.15.1
-
cpe:2.3:a:ws_project:ws:8.16.0
-
cpe:2.3:a:ws_project:ws:8.17.0
-
cpe:2.3:a:ws_project:ws:8.17.1
-
cpe:2.3:a:ws_project:ws:8.18.0
-
cpe:2.3:a:ws_project:ws:8.18.1
-
cpe:2.3:a:ws_project:ws:8.18.2
-
cpe:2.3:a:ws_project:ws:8.18.3
-
cpe:2.3:a:ws_project:ws:8.19.0
-
cpe:2.3:a:ws_project:ws:8.2.0
-
cpe:2.3:a:ws_project:ws:8.2.1
-
cpe:2.3:a:ws_project:ws:8.2.2
-
cpe:2.3:a:ws_project:ws:8.2.3
-
cpe:2.3:a:ws_project:ws:8.20.0
-
cpe:2.3:a:ws_project:ws:8.3.0
-
cpe:2.3:a:ws_project:ws:8.4.0
-
cpe:2.3:a:ws_project:ws:8.4.1
-
cpe:2.3:a:ws_project:ws:8.4.2
-
cpe:2.3:a:ws_project:ws:8.5.0
-
cpe:2.3:a:ws_project:ws:8.6.0
-
cpe:2.3:a:ws_project:ws:8.7.0
-
cpe:2.3:a:ws_project:ws:8.8.0
-
cpe:2.3:a:ws_project:ws:8.8.1
-
cpe:2.3:a:ws_project:ws:8.9.0