GHSA-96hv-2xvq-fx4p
High · 7.5CVSS
7.5
EPSS
—
Published
Jun 15, 2026
CISA due date
—
The record
ws: Memory exhaustion DoS from tiny fragments and data chunks
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | ws | 1.1.0 | 5.2.5 |
| npm | ws | 6.0.0 | 6.2.4 |
| npm | ws | 7.0.0 | 7.5.11 |
| npm | ws | 8.0.0 | 8.21.0 |
Related vulnerabilities
- CVE-2026-48779 ws is an open source WebSocket client and server for Node.js. Same vulnerability
- GHSA-58qx-3vcg-4xpx ws: Uninitialized memory disclosure Also affects ws
- CVE-2026-45736 ws is an open source WebSocket client and server for Node.js. Also affects ws
- CVE-2024-37890 ws is an open source WebSocket client and server for Node.js. Also affects ws
- GHSA-5v72-xg48-5rpm Denial of Service in ws Also affects ws
- CVE-2026-113795 pypdf is a free and open-source pure-python PDF library. CWE-400
- CVE-2026-83400 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-400
- CVE-2026-112400 Pillow is a Python imaging library. CWE-400