CVE-2026-45736

Medium

Open

TLP:CLEAR

ws: Uninitialized memory disclosure

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

Details

CVSS Score: 4.4
EPSS Score ⓘ: 0.75%

51.4th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Confidence: 90%
Published: May 15, 2026
Last Modified: Aug 12, 2026

Notes

0

Log in to add a note

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

0

Log in to add an opinion

No opinions yet. Be the first to assess this intelligence.