{"id":"CVE-2026-48779","title":"ws is an open source WebSocket client and server for Node.js","summary":"ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS v…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400","CWE-770","CWE-1050"],"vendor":"ws_project","product":"ws","affected":["ws >= 1.1.0, < 5.2.5","ws >= 6.0.0, < 6.2.4","ws >= 7.0.0, < 7.5.11","ws >= 8.0.0, < 8.21.0"],"patched":["ws 8.21.0"],"published":"2026-06-17","updated":"2026-09-11","sourceUpdated":"2026-09-11T13:18:14.097","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48779","references":[{"url":"https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","label":"security-advisories@github.com"},{"url":"https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","label":"security-advisories@github.com"},{"url":"https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","label":"security-advisories@github.com"},{"url":"https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","label":"security-advisories@github.com"},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:29197","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33155","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33160","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33163","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33173","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33183","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33574","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34342","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36754","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36820","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37272","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40984","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41928","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41941","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41944","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:48151","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:56366","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:56431","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57013","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57590","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:65126","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:66488","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:66545","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-48779","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489661","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48779"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48779"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-06-17T18:07:28.748295Z"},"epss":0.00812,"epssPercentile":0.55008,"ingestedAt":"2026-07-07T13:53:11.850Z","slug":"CVE-2026-48779","body":"## Overview\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.\n\n## Affected\n\n- `ws >= 1.1.0, < 5.2.5`\n- `ws >= 6.0.0, < 6.2.4`\n- `ws >= 7.0.0, < 7.5.11`\n- `ws >= 8.0.0, < 8.21.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `ws 8.21.0`\n\n## Vendor advisories\n\n- **RHSA-2026:48151** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48151)\n- **RHSA-2026:34342** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34342)\n- **RHSA-2026:57590** · Red Hat · fixed in: Red Hat Enterprise Linux Extensions Channel (v. 10) · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57590)\n- **RHSA-2026:36754** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36754)\n- **RHSA-2026:33574** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-06-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:33574)\n- **RHSA-2026:29197** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:29197)\n- **RHSA-2026:41928** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41928)\n- **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126)\n- **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520)\n- **RHSA-2026:36820** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.29 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36820)\n- **RHSA-2026:33155** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 2.6 · released 2026-06-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:33155)\n- **Red Hat VEX** · Important · affected: Node HealthCheck Operator, OpenShift Lightspeed, OpenShift Pipelines, Red Hat Ansible Automation Platform 2, Red Hat build of Apache Camel - HawtIO 4, Red Hat Build of Podman Desktop, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Build of Podman Desktop - Tech Preview, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Fuse 7, … · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json)\n- **RHSA-2026:66545** · Red Hat · fixed in: Red Hat AMQ Broker 7.13.6 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66545)\n- **RHSA-2026:66488** · Red Hat · fixed in: Red Hat AMQ Broker 7.14.1 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66488)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":201704,"id":"CVE-2026-48779","ts":1789399627638,"field":"exploit_available","old":"false","new":"true"},{"seq":200436,"id":"CVE-2026-48779","ts":1789397259873,"field":"exploit_available","old":"true","new":"false"},{"seq":198359,"id":"CVE-2026-48779","ts":1789391865593,"field":"exploit_available","old":"false","new":"true"},{"seq":196151,"id":"CVE-2026-48779","ts":1789383514345,"field":"exploit_available","old":"true","new":"false"},{"seq":195080,"id":"CVE-2026-48779","ts":1789380394777,"field":"exploit_available","old":"false","new":"true"},{"seq":193867,"id":"CVE-2026-48779","ts":1789378379741,"field":"exploit_available","old":"true","new":"false"},{"seq":192654,"id":"CVE-2026-48779","ts":1789376343690,"field":"exploit_available","old":"false","new":"true"},{"seq":191441,"id":"CVE-2026-48779","ts":1789373280472,"field":"exploit_available","old":"true","new":"false"},{"seq":190226,"id":"CVE-2026-48779","ts":1789369228453,"field":"exploit_available","old":"false","new":"true"},{"seq":189013,"id":"CVE-2026-48779","ts":1789368160862,"field":"exploit_available","old":"true","new":"false"},{"seq":187796,"id":"CVE-2026-48779","ts":1789365081077,"field":"exploit_available","old":"false","new":"true"},{"seq":186583,"id":"CVE-2026-48779","ts":1789363145451,"field":"exploit_available","old":"true","new":"false"},{"seq":185369,"id":"CVE-2026-48779","ts":1789361039316,"field":"exploit_available","old":"false","new":"true"},{"seq":184156,"id":"CVE-2026-48779","ts":1789358047019,"field":"exploit_available","old":"true","new":"false"},{"seq":182407,"id":"CVE-2026-48779","ts":1789354162523,"field":"exploit_available","old":"false","new":"true"},{"seq":181200,"id":"CVE-2026-48779","ts":1789353029400,"field":"exploit_available","old":"true","new":"false"},{"seq":179993,"id":"CVE-2026-48779","ts":1789350101112,"field":"exploit_available","old":"false","new":"true"},{"seq":178786,"id":"CVE-2026-48779","ts":1789347981905,"field":"exploit_available","old":"true","new":"false"},{"seq":177579,"id":"CVE-2026-48779","ts":1789346237562,"field":"exploit_available","old":"false","new":"true"},{"seq":176372,"id":"CVE-2026-48779","ts":1789342897785,"field":"exploit_available","old":"true","new":"false"},{"seq":175826,"id":"CVE-2026-48779","ts":1789338681909,"field":"exploit_available","old":"false","new":"true"},{"seq":175696,"id":"CVE-2026-48779","ts":1789338501612,"field":"exploit_available","old":"true","new":"false"},{"seq":174491,"id":"CVE-2026-48779","ts":1789334680676,"field":"exploit_available","old":"false","new":"true"},{"seq":173286,"id":"CVE-2026-48779","ts":1789333366374,"field":"exploit_available","old":"true","new":"false"},{"seq":172100,"id":"CVE-2026-48779","ts":1789330950068,"field":"exploit_available","old":"false","new":"true"},{"seq":170914,"id":"CVE-2026-48779","ts":1789328497677,"field":"exploit_available","old":"true","new":"false"},{"seq":169709,"id":"CVE-2026-48779","ts":1789326992945,"field":"exploit_available","old":"false","new":"true"},{"seq":168504,"id":"CVE-2026-48779","ts":1789323551542,"field":"exploit_available","old":"true","new":"false"},{"seq":167299,"id":"CVE-2026-48779","ts":1789319442277,"field":"exploit_available","old":"false","new":"true"},{"seq":166094,"id":"CVE-2026-48779","ts":1789318444905,"field":"exploit_available","old":"true","new":"false"},{"seq":164889,"id":"CVE-2026-48779","ts":1789315634024,"field":"exploit_available","old":"false","new":"true"},{"seq":163684,"id":"CVE-2026-48779","ts":1789313363160,"field":"exploit_available","old":"true","new":"false"},{"seq":162479,"id":"CVE-2026-48779","ts":1789311764186,"field":"exploit_available","old":"false","new":"true"},{"seq":161274,"id":"CVE-2026-48779","ts":1789308402790,"field":"exploit_available","old":"true","new":"false"},{"seq":160779,"id":"CVE-2026-48779","ts":1789304333969,"field":"exploit_available","old":"false","new":"true"},{"seq":160326,"id":"CVE-2026-48779","ts":1789303899198,"field":"exploit_available","old":"true","new":"false"},{"seq":159387,"id":"CVE-2026-48779","ts":1789300348213,"field":"exploit_available","old":"false","new":"true"},{"seq":158617,"id":"CVE-2026-48779","ts":1789299396413,"field":"exploit_available","old":"true","new":"false"},{"seq":157581,"id":"CVE-2026-48779","ts":1789296530110,"field":"exploit_available","old":"false","new":"true"},{"seq":156376,"id":"CVE-2026-48779","ts":1789294482563,"field":"exploit_available","old":"true","new":"false"},{"seq":155171,"id":"CVE-2026-48779","ts":1789292736714,"field":"exploit_available","old":"false","new":"true"},{"seq":153966,"id":"CVE-2026-48779","ts":1789289459575,"field":"exploit_available","old":"true","new":"false"},{"seq":152616,"id":"CVE-2026-48779","ts":1789281383688,"field":"exploit_available","old":"false","new":"true"},{"seq":152256,"id":"CVE-2026-48779","ts":1789280989035,"field":"exploit_available","old":"true","new":"false"},{"seq":151217,"id":"CVE-2026-48779","ts":1789277484735,"field":"exploit_available","old":"false","new":"true"},{"seq":150178,"id":"CVE-2026-48779","ts":1789275954382,"field":"exploit_available","old":"true","new":"false"},{"seq":149145,"id":"CVE-2026-48779","ts":1789273649761,"field":"exploit_available","old":"false","new":"true"},{"seq":148112,"id":"CVE-2026-48779","ts":1789271006606,"field":"exploit_available","old":"true","new":"false"},{"seq":146152,"id":"CVE-2026-48779","ts":1789269229956,"field":"exploit_available","old":"false","new":"true"},{"seq":145054,"id":"CVE-2026-48779","ts":1789266210755,"field":"exploit_available","old":"true","new":"false"}]}