GHSA-58qx-3vcg-4xpx
Medium · 4.4CVSS
4.4
EPSS
—
Published
May 18, 2026
CISA due date
—
The record
ws: Uninitialized memory disclosure
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | ws | 8.0.0 | 8.20.1 |
Related vulnerabilities
- CVE-2026-45736 ws is an open source WebSocket client and server for Node.js. Same vulnerability
- CVE-2026-48779 ws is an open source WebSocket client and server for Node.js. Also affects ws
- GHSA-96hv-2xvq-fx4p ws: Memory exhaustion DoS from tiny fragments and data chunks Also affects ws
- CVE-2024-37890 ws is an open source WebSocket client and server for Node.js. Also affects ws
- GHSA-5v72-xg48-5rpm Denial of Service in ws Also affects ws
- CVE-2026-112897 Pillow is a Python imaging library. CWE-908
- CVE-2026-109273 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure… CWE-908
- CVE-2026-107676 FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in… CWE-908