{"id":"CVE-2026-45736","title":"ws is an open source WebSocket client and server for Node.js","summary":"ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability i…","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-908","CWE-824"],"vendor":"ws_project","product":"ws","affected":["ws >= 8.0.0, < 8.20.1"],"patched":["ws 8.20.1"],"published":"2026-05-15","updated":"2026-09-11","sourceUpdated":"2026-09-11T13:18:11.290","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45736","references":[{"url":"https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086","label":"security-advisories@github.com"},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:26638","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26994","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27171","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:29197","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33574","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34374","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36754","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36820","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37272","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40768","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40792","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41928","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:44235","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:44263","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:44267","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:48151","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:48693","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:56366","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:56431","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:56928","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57013","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57590","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:65126","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:66488","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:66545","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:7655","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-45736","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477914","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45736.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-05-16T01:08:38.777055Z"},"epss":0.00745,"epssPercentile":0.53299,"ingestedAt":"2026-07-01T15:50:58.843Z","slug":"CVE-2026-45736","body":"## Overview\n\nws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.\n\n## Affected\n\n- `ws >= 8.0.0, < 8.20.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `ws 8.20.1`","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":24.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201684,"id":"CVE-2026-45736","ts":1789399605883,"field":"exploit_available","old":"false","new":"true"},{"seq":200416,"id":"CVE-2026-45736","ts":1789397214819,"field":"exploit_available","old":"true","new":"false"},{"seq":198340,"id":"CVE-2026-45736","ts":1789391850445,"field":"exploit_available","old":"false","new":"true"},{"seq":196133,"id":"CVE-2026-45736","ts":1789383490682,"field":"exploit_available","old":"true","new":"false"},{"seq":195062,"id":"CVE-2026-45736","ts":1789380375072,"field":"exploit_available","old":"false","new":"true"},{"seq":193849,"id":"CVE-2026-45736","ts":1789378338481,"field":"exploit_available","old":"true","new":"false"},{"seq":192636,"id":"CVE-2026-45736","ts":1789376325192,"field":"exploit_available","old":"false","new":"true"},{"seq":191423,"id":"CVE-2026-45736","ts":1789373247080,"field":"exploit_available","old":"true","new":"false"},{"seq":190208,"id":"CVE-2026-45736","ts":1789369203442,"field":"exploit_available","old":"false","new":"true"},{"seq":188995,"id":"CVE-2026-45736","ts":1789368113543,"field":"exploit_available","old":"true","new":"false"},{"seq":187778,"id":"CVE-2026-45736","ts":1789365064555,"field":"exploit_available","old":"false","new":"true"},{"seq":186565,"id":"CVE-2026-45736","ts":1789363093442,"field":"exploit_available","old":"true","new":"false"},{"seq":185351,"id":"CVE-2026-45736","ts":1789361027464,"field":"exploit_available","old":"false","new":"true"},{"seq":184138,"id":"CVE-2026-45736","ts":1789358015132,"field":"exploit_available","old":"true","new":"false"},{"seq":182389,"id":"CVE-2026-45736","ts":1789354157193,"field":"exploit_available","old":"false","new":"true"},{"seq":181182,"id":"CVE-2026-45736","ts":1789352998779,"field":"exploit_available","old":"true","new":"false"},{"seq":179975,"id":"CVE-2026-45736","ts":1789350082441,"field":"exploit_available","old":"false","new":"true"},{"seq":178768,"id":"CVE-2026-45736","ts":1789347933832,"field":"exploit_available","old":"true","new":"false"},{"seq":177561,"id":"CVE-2026-45736","ts":1789346219833,"field":"exploit_available","old":"false","new":"true"},{"seq":176354,"id":"CVE-2026-45736","ts":1789342849497,"field":"exploit_available","old":"true","new":"false"},{"seq":175808,"id":"CVE-2026-45736","ts":1789338632961,"field":"exploit_available","old":"false","new":"true"},{"seq":175678,"id":"CVE-2026-45736","ts":1789338464613,"field":"exploit_available","old":"true","new":"false"},{"seq":174473,"id":"CVE-2026-45736","ts":1789334662151,"field":"exploit_available","old":"false","new":"true"},{"seq":173268,"id":"CVE-2026-45736","ts":1789333341702,"field":"exploit_available","old":"true","new":"false"},{"seq":172082,"id":"CVE-2026-45736","ts":1789330941262,"field":"exploit_available","old":"false","new":"true"},{"seq":170896,"id":"CVE-2026-45736","ts":1789328458695,"field":"exploit_available","old":"true","new":"false"},{"seq":169691,"id":"CVE-2026-45736","ts":1789326978563,"field":"exploit_available","old":"false","new":"true"},{"seq":168486,"id":"CVE-2026-45736","ts":1789323530413,"field":"exploit_available","old":"true","new":"false"},{"seq":167281,"id":"CVE-2026-45736","ts":1789319423541,"field":"exploit_available","old":"false","new":"true"},{"seq":166076,"id":"CVE-2026-45736","ts":1789318401229,"field":"exploit_available","old":"true","new":"false"},{"seq":164871,"id":"CVE-2026-45736","ts":1789315614641,"field":"exploit_available","old":"false","new":"true"},{"seq":163666,"id":"CVE-2026-45736","ts":1789313339295,"field":"exploit_available","old":"true","new":"false"},{"seq":162461,"id":"CVE-2026-45736","ts":1789311752492,"field":"exploit_available","old":"false","new":"true"},{"seq":161256,"id":"CVE-2026-45736","ts":1789308363349,"field":"exploit_available","old":"true","new":"false"},{"seq":160761,"id":"CVE-2026-45736","ts":1789304304035,"field":"exploit_available","old":"false","new":"true"},{"seq":158599,"id":"CVE-2026-45736","ts":1789299355090,"field":"exploit_available","old":"true","new":"false"},{"seq":157563,"id":"CVE-2026-45736","ts":1789296514355,"field":"exploit_available","old":"false","new":"true"},{"seq":156358,"id":"CVE-2026-45736","ts":1789294455664,"field":"exploit_available","old":"true","new":"false"},{"seq":155153,"id":"CVE-2026-45736","ts":1789292716983,"field":"exploit_available","old":"false","new":"true"},{"seq":153948,"id":"CVE-2026-45736","ts":1789289432521,"field":"exploit_available","old":"true","new":"false"},{"seq":152598,"id":"CVE-2026-45736","ts":1789281349946,"field":"exploit_available","old":"false","new":"true"},{"seq":150160,"id":"CVE-2026-45736","ts":1789275923785,"field":"exploit_available","old":"true","new":"false"},{"seq":149127,"id":"CVE-2026-45736","ts":1789273630767,"field":"exploit_available","old":"false","new":"true"},{"seq":148094,"id":"CVE-2026-45736","ts":1789270961199,"field":"exploit_available","old":"true","new":"false"},{"seq":146134,"id":"CVE-2026-45736","ts":1789269213313,"field":"exploit_available","old":"false","new":"true"},{"seq":145036,"id":"CVE-2026-45736","ts":1789266180564,"field":"exploit_available","old":"true","new":"false"},{"seq":143940,"id":"CVE-2026-45736","ts":1789262510514,"field":"exploit_available","old":"false","new":"true"},{"seq":142776,"id":"CVE-2026-45736","ts":1789261272622,"field":"exploit_available","old":"true","new":"false"},{"seq":141612,"id":"CVE-2026-45736","ts":1789258658492,"field":"exploit_available","old":"false","new":"true"},{"seq":140414,"id":"CVE-2026-45736","ts":1789256466287,"field":"exploit_available","old":"true","new":"false"}]}