Read the docs

faye

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

faye records in CISA KEV

No faye vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Websocket-driver 3 records MEDIUM

Records

9 records

TI-2020-08894 CVE-2020-11020 · GHSA-qpg4-4w7w-2mq5

Authentication and extension bypass in Faye

Priority MEDIUM 45

Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01573 Published 2020-04-29 Fixed in 1.0.4, 1.1.3 +1 CWE-287
TI-2020-11907 CVE-2020-15134 · GHSA-3q49-h8f9-9fr9

Missing TLS certificate verification in Faye

Priority LOW 39

Faye before version 1.4.0, there is a lack of certification validation in TLS handshakes.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.00864 Published 2020-07-31 Fixed in 1.4.0 CWE-295
TI-2020-11906 CVE-2020-15133 · GHSA-2v5c-755p-p4gv

Missing TLS certificate verification in Faye Websocket

Priority LOW 39

In faye-websocket before version 0.11.0, there is a lack of certification validation in TLS handshakes.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.00918 Published 2020-07-31 Fixed in 0.11.0 CWE-295
TI-2026-39321 CVE-2026-54464 · GHSA-33ph-fccm-39pj

websocket-driver: Resource limit bypass via message compression

Priority LOW 34

### Impact If this library is used in tandem with the `permessage-deflate` extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00445 Published 2026-07-17 Partial fix · 0.8.1 CWE-770
Open these records in search →