CVE-2026-48779

Aliases:GHSA-96hv-2xvq-fx4p
Advisory lineage Upstream: 0 Downstream: 7
PUBLISHED
Published: 16 Jun 2026, 21:26
Last modified:21 Jul 2026, 12:05

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.78% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

16 Jun 2026, 21:26
Published
Vulnerability first disclosed
21 Jul 2026, 12:05
Last Modified
Vulnerability information updated

Description

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.78%• Percentile: 52%

Techniques & Countermeasures

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

  • CWE-770•Allocation of Resources Without Limits or Throttling

    The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

  • CWE-1050•Excessive Platform Resource Consumption within a Loop

    The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.

Affected Systems

  • Npm•ws

    ≥ 1.1.0, < 5.2.5 | ≥ 6.0.0, < 6.2.4 | ≥ 7.0.0, < 7.5.11 | ≥ 8.0.0, < 8.21.0

  • websockets•ws

    ≥ 1.1.0, < 5.2.5 | ≥ 6.0.0, < 6.2.4 | ≥ 7.0.0, < 7.5.11 | ≥ 8.0.0, < 8.21.0

References (27)