Executive brief
A vulnerability in the websocket-driver library, which handles real-time communication for web applications, could allow an attacker to corrupt data. By sending specially crafted messages, an attacker can cause the server to misinterpret data, potentially leading to unauthorized modifications or security bypasses. This affects applications using older versions of the WebSocket protocol (Draft 75/76).
Technical details
A vulnerability exists in the draft WebSocket protocol handler (specifically draft75.js) of the websocket-driver library. The frame format in these draft versions uses a length header that allows an arbitrarily large integer to be encoded. By sending a continuous sequence of bytes with the high bit set (0x80 or above), an attacker can cause the server to calculate an increasingly large integer. Because JavaScript uses 64-bit floating point numbers, this value eventually loses precision, causing the parser to miscalculate the payload boundary and incorrectly process subsequent data. This is a remote, unauthenticated attack that impacts data integrity. The issue is fixed in version 0.7.5 by enforcing a maximum length check.
Affected products
- faye websocket-driver-node < 0.7.5
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE published to NVD