Executive brief
The 'ws' library, a popular tool for handling real-time WebSocket communications in Node.js applications, is vulnerable to a denial-of-service attack. An attacker can send a flood of specially crafted small data fragments that force the server to consume excessive amounts of memory. This can lead to the application crashing or becoming unresponsive, potentially disrupting services for all users.
Technical details
The 'ws' library for Node.js is vulnerable to uncontrolled resource consumption (CWE-400/CWE-770). An attacker can exploit this by sending a high volume of exceptionally small WebSocket fragments and data chunks. While the total data size may remain under the documented 'maxPayload' limit, the library allocates structural wrappers for each fragment. This overhead causes the process to consume significantly more memory than expected, eventually leading to an Out of Memory (OOM) error and process termination. The vulnerability is reachable over the network without authentication. Fixes are available in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.
Affected products
- websockets ws >= 1.1.0, < 5.2.5; >= 6.0.0, < 6.2.4; >= 7.0.0, < 7.5.11; >= 8.0.0, < 8.21.0
Timeline
- 2026-05-22: advisory: GitHub Security Advisory GHSA-96hv-2xvq-fx4p published
- 2026-06-17: disclosed: CVE-2026-48779 published to NVD
References
- https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7
- https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53
- https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94
- https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8
- https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p