← CVE Intelligence

CVE-2026-45736

ws: Uninitialized memory disclosure PUBLISHED

Description (CNA)

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

Affected (CNA)

Vendor / productVersions
websockets / wsaffected >= 8.0.0, < 8.20.1

CWE

CWE-908

References

ADP enrichment

CISA-ADP

No English description supplied.

redhat-SADP

A flaw was found in ws, an open source WebSocket client and server for Node.js. The `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray` is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memory.