CVE-2026-45736: ws Package Uninitialized Memory Disclosure Vulnerability
Summary
CVE-2026-45736: ws: Uninitialized memory disclosure. Affects ws versions >= 8.0.0, < 8.20.1. Fixed in 8.20.1. How to fix ↓
Also tracked for
- ws · ghsa
The same CVE-2026-45736 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'ws' package is a popular WebSocket implementation for Node.js, enabling real-time communication between clients and servers. It is widely used in applications that require persistent connections, such as chat applications and live data feeds. The package is known for its performance and ease of use, but it has been found to have a vulnerability that can lead to uninitialized memory disclosure when improperly used.
Vulnerability Detail
The vulnerability arises from the 'websocket.close()' method, which can disclose uninitialized memory when a TypedArray is passed as the reason argument. This can potentially expose sensitive data from memory, leading to security risks. The flaw is categorized under CWE-908, indicating a risk of uninitialized memory access. Although the calculated CVSS severity is medium, the actual risk is considered low due to the specific misuse required to exploit it.
How To Fix
Latest published version: 8.22.0 as of 22 Oct 2026
npm install ws@8.22.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.20.1
This is the first release that contains the fix.
npm install ws@8.20.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, avoid passing TypedArray objects as the reason argument in the 'websocket.close()' method. Instead, use a string or a Buffer to prevent uninitialized memory disclosure. Here is an example of a safe implementation:
ws.close(1000, Buffer.from('Closing connection'));
Conclusion
The ws package has a vulnerability that can lead to uninitialized memory disclosure when misused. It is important to update to the patched version to mitigate risks. Users should also be cautious about how they implement the websocket.close() method to avoid potential security issues.
See every vulnerability recorded for ws →
FAQ
The vulnerability involves uninitialized memory disclosure when a TypedArray is passed as the reason argument to the websocket.close() method.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 4.4, indicating a moderate level of severity.
If immediate updates are not possible, ensure that you do not pass TypedArray objects to the websocket.close() method as a temporary measure.
The vulnerability was privately disclosed by Nikita Skovoroda, who is credited for responsibly reporting the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for ws.
