CVE-2026-45736

[mateBe95]

Description: ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

Please update ws to 8.20.1

[NormandoHall]

Link: GHSA-58qx-3vcg-4xpx

[AviVahl]

#5439
No response from author, though...

[NormandoHall]

#5439 No response from author, though...

Meanwhile add to package.json

  "overrides": {
    "ws": "8.20.1"
  }

Then npm i

[chadlwilson]

This is merged/fixed via #5439 now; pending release.

[darrachequesne]

New releases which use ws@~8.20.1:

• engine.io@6.6.8: https://github.com/socketio/socket.io/releases/tag/engine.io%406.6.8
• engine.io-client@6.6.5: https://github.com/socketio/socket.io/releases/tag/engine.io-client%406.6.5
• socket.io-adapter@2.5.7: https://github.com/socketio/socket.io/releases/tag/socket.io-adapter%402.5.7

Thanks for the heads-up 👍