Skip to content

Vendor

ws project vulnerabilities

5 published CVES affecting ws project, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
5
Critical
0
High
4
Medium
1
Low
0
Unscored
0
CISA KEV
0
Atom feed of ws project alerts

Products

Latest ws project CVEs

Newest publication first

  1. CVE-2026-48779 ws: Memory exhaustion DoS from tiny fragments and data chunks

    Published
    HighCVSS 7.5 EPSS 1.4%

    ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume...

  2. CVE-2026-45736 ws: Uninitialized memory disclosure

    Published
    HighCVSS 7.5 EPSS 0.75%

    ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

  3. CVE-2021-32640 ReDoS in Sec-Websocket-Protocol header

    Published
    MediumCVSS 5.3 EPSS 2.8%

    ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec7...

  4. CVE-2016-10518 Remote Memory Disclosure in ws

    Published
    HighCVSS 7.5 EPSS 1.9%

    A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly wha...

  5. CVE-2016-10542 DoS due to excessively large websocket message in ws

    Published
    HighCVSS 7.5 EPSS 7.3% Framework module

    ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.