CVE-2026-45736mediumCWE-824 CWE-908

ws: Uninitialized memory disclosure

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.4epss 0.7%

exploitation probability

0.7%top 47% of all CVEs

observed exploitation

nono source reports it

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected products

websockets · ws

References