Vulnerability Details CVE-2026-45736
ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 1.8%
CVSS Severity
CVSS v3 Score 4.4
References
Products affected by CVE-2026-45736
-
cpe:2.3:a:ws_project:ws:8.0.0
-
cpe:2.3:a:ws_project:ws:8.1.0
-
cpe:2.3:a:ws_project:ws:8.10.0
-
cpe:2.3:a:ws_project:ws:8.11.0
-
cpe:2.3:a:ws_project:ws:8.12.0
-
cpe:2.3:a:ws_project:ws:8.12.1
-
cpe:2.3:a:ws_project:ws:8.13.0
-
cpe:2.3:a:ws_project:ws:8.14.0
-
cpe:2.3:a:ws_project:ws:8.14.1
-
cpe:2.3:a:ws_project:ws:8.14.2
-
cpe:2.3:a:ws_project:ws:8.15.0
-
cpe:2.3:a:ws_project:ws:8.15.1
-
cpe:2.3:a:ws_project:ws:8.16.0
-
cpe:2.3:a:ws_project:ws:8.17.0
-
cpe:2.3:a:ws_project:ws:8.17.1
-
cpe:2.3:a:ws_project:ws:8.18.0
-
cpe:2.3:a:ws_project:ws:8.18.1
-
cpe:2.3:a:ws_project:ws:8.18.2
-
cpe:2.3:a:ws_project:ws:8.18.3
-
cpe:2.3:a:ws_project:ws:8.19.0
-
cpe:2.3:a:ws_project:ws:8.2.0
-
cpe:2.3:a:ws_project:ws:8.2.1
-
cpe:2.3:a:ws_project:ws:8.2.2
-
cpe:2.3:a:ws_project:ws:8.2.3
-
cpe:2.3:a:ws_project:ws:8.20.0
-
cpe:2.3:a:ws_project:ws:8.3.0
-
cpe:2.3:a:ws_project:ws:8.4.0
-
cpe:2.3:a:ws_project:ws:8.4.1
-
cpe:2.3:a:ws_project:ws:8.4.2
-
cpe:2.3:a:ws_project:ws:8.5.0
-
cpe:2.3:a:ws_project:ws:8.6.0
-
cpe:2.3:a:ws_project:ws:8.7.0
-
cpe:2.3:a:ws_project:ws:8.8.0
-
cpe:2.3:a:ws_project:ws:8.8.1
-
cpe:2.3:a:ws_project:ws:8.9.0