CVE-2026-45736: websockets ws uninitialized memory disclosure in websocket.close

CVE-2026-45736 · Severity: medium · CVSS 4.4 · Published 2026-05-15

The ws library is a widely-used WebSocket client and server for Node.js. When the close() method is called with a TypedArray as the reason argument, it fails to properly clear sensitive memory, potentially leaking uninitialized data to the remote peer. While the vulnerability requires misuse of the API (passing a TypedArray instead of a string or Buffer), it could expose sensitive server memory in applications that use this pattern.

Technologies: ws (npm). Vendors: npm.

Quick answers

Is CVE-2026-45736 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45736 being exploited in the wild.
How severe is CVE-2026-45736?
Medium severity, with a CVSS score of 4.4, published 15 May 2026.
Which products and versions are affected?
ws (npm) >= 8.0.0, < 8.20.1, SEMVER:introduced=8.0.0,fixed=8.20.1.
Is there a fix for CVE-2026-45736?
Yes. ws (npm): upgrade to 8.20.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45736 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45736?
Check whether you run ws (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ws (npm): upgrade to 8.20.1 or later
    npm install ws@8.20.1

Technical details

The vulnerability is a use-of-uninitialized-resource (CWE-908) flaw in the websocket.close() implementation. When a TypedArray (e.g., Float32Array) is passed as the reason argument instead of a string or Buffer, the code does not correctly validate or handle the type, resulting in disclosure of uninitialized memory from a Buffer.allocUnsafe()-allocated buffer. The attack requires the attacker to control the reason argument passed to close(), which typically requires application-level misuse; no user interaction is required. An attacker can read sensitive data (e.g., API keys, internal buffers) from the server process memory that is transmitted to the remote peer. The vulnerability was fixed in ws@8.20.1 by adding stricter validation for the reason argument type.

Affected products

  • websockets ws >=8.0.0, <8.20.1

Identifiers

  • CVE-2026-45736
  • GHSA-58qx-3vcg-4xpx

Timeline

  • 2026-05-18: disclosed
  • 2026-05-18: patched: Fixed in ws@8.20.1 (commit c0327ec15a54d701eb6ccefaa8bef328cfc03086)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.