ws: Uninitialized memory disclosure
Priority HIGH 66CWE-908Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 24 fixed, 15 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-908 and the CVSS impact.
Summary
ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00745 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial ws (websockets): 8.20.1ws (npm): 8.20.1Red Hat: 30 advisoriesRed Hat: 24 fixed, 15 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| websockets | ws | 8.0.0 to before 8.20.1 | 8.20.1 | Patch available | CNA |
| — | ws (npm) | 8.0.0 to before 8.20.1 | 8.20.1 | Patch available | GHSA-58qx-3vcg-4xpx |
- ws Vendorwebsockets Affected 8.0.0 to before 8.20.1 Fixed in 8.20.1 Patch available CNA
- ws (npm) Vendor— Affected 8.0.0 to before 8.20.1 Fixed in 8.20.1 Patch available GHSA-58qx-3vcg-4xpx
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ws_project:ws:*:*:*:*:*:node.js:*:* | 8.0.0 to before 8.20.1 | Vulnerable | websockets |
- cpe:2.3:a:ws_project:ws:*:*:*:*:*:node.js:*:* Versions 8.0.0 to before 8.20.1 Vulnerable ·websockets
Remediation
- Fix · CNA ws (websockets) Fixed in 8.20.1
- Fix · GHSA-58qx-3vcg-4xpx ws (npm) Fixed in 8.20.1 Advisory →
Red Hat 30 advisories
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
- RHSA-2026:73987 Released 2026-09-30 · Red Hat rating CriticalRHOAI 3.3.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
- RHSA-2026:70829 Released 2026-09-23 · Red Hat rating ImportantRHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
Show 27 more Red Hat advisories
- RHSA-2026:66545 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.13.6 release and security update
- Red Hat AMQ Broker 7.13.6
- RHSA-2026:66488 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.14.1 release and security update
- Red Hat AMQ Broker 7.14.1
- RHSA-2026:65126 Released 2026-09-08 · Red Hat rating ImportantRHOAI 2.25.11 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:60520 Released 2026-08-27 · Red Hat rating CriticalRHOAI 3.4.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
- RHSA-2026:57590 Released 2026-08-20 · Red Hat rating Importantrh-podman-desktop security, bug fix, and enhancement update
- Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop-1.1.2-1.el10_2
- RHSA-2026:57013 Released 2026-08-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.20.17 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
- RHSA-2026:56928 Released 2026-08-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +25
- RHSA-2026:56431 Released 2026-08-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
- RHSA-2026:56366 Released 2026-08-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.19.22 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
- RHSA-2026:48693 Released 2026-08-04 · Red Hat rating CriticalOpenShift Container Platform 4.22.8 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-hypershift-rhel9, registry.redhat.io/openshift4/ose-installer-artifacts-rhel9 +2
- RHSA-2026:48151 Released 2026-07-29 · Red Hat rating ImportantRed Hat build of Cryostat security update
- Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
- RHSA-2026:44235 Released 2026-07-29 · Red Hat rating ImportantOpenShift Container Platform 4.19.40 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +2
- RHSA-2026:44267 Released 2026-07-28 · Red Hat rating ImportantOpenShift Container Platform 4.21.26 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-azure-workload-identity-webhook-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +1
- RHSA-2026:44263 Released 2026-07-28 · Red Hat rating ImportantOpenShift Container Platform 4.20.31 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9 +1
- RHSA-2026:40768 Released 2026-07-21 · Red Hat rating ImportantOpenShift Container Platform 4.22.6 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-cluster-monitoring-rhel9-operator, registry.redhat.io/openshift4/ose-console-rhel9 +1
- RHSA-2026:40792 Released 2026-07-21 · Red Hat rating ImportantOpenShift Container Platform 4.21.25 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9 +1
- RHSA-2026:41928 Released 2026-07-20 · Red Hat rating ImportantRed Hat Migration Toolkit for Containers
- Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
- RHSA-2026:37272 Released 2026-07-09 · Red Hat rating ImportantRHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
- RHSA-2026:36820 Released 2026-07-08 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.29.0 Release.
- Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/multicluster-redirector-rhel9 +6
- RHSA-2026:36754 Released 2026-07-08 · Red Hat rating ImportantRed Hat Developer Hub 1.10.2 release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:34374 Released 2026-07-01 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +5
- RHSA-2026:33574 Released 2026-06-30 · Red Hat rating ImportantRed Hat Developer Hub 1.9.6 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:29197 Released 2026-06-24 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:27171 Released 2026-06-19 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images dotnet-sdk-9.0-9.0.118-1.hum1@aarch64, dotnet-sdk-9.0-9.0.118-1.hum1@x86_64, dotnet-sdk-9.0-source-built-artifacts-9.0.118-1.hum1@aarch64 +10
- RHSA-2026:26994 Released 2026-06-18 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images dotnet-sdk-8.0-8.0.128-1.hum1@aarch64, dotnet-sdk-8.0-8.0.128-1.hum1@x86_64, dotnet-sdk-8.0-source-built-artifacts-8.0.128-1.hum1@aarch64 +6
- RHSA-2026:26638 Released 2026-06-17 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images dotnet-sdk-10.0-10.0.109-1.hum1@aarch64, dotnet-sdk-10.0-10.0.109-1.hum1@x86_64, dotnet-sdk-10.0-source-built-artifacts-10.0.109-1.hum1@aarch64 +8
- RHSA-2026:7655 Released 2026-04-11 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images yarnpkg-1.22.22-18.1.hum1@aarch64, yarnpkg-1.22.22-18.1.hum1@src, yarnpkg-1.22.22-18.1.hum1@x86_64
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Node HealthCheck Operator | Affected | No fix yet |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat Build of Podman Desktop - Tech Preview | Affected | No fix planned: Will not fix |
| Red Hat Connectivity Link 1 | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Self-service automation portal 2 | Affected | No fix yet |
| Cryostat 4 on RHEL 9 | Fixed | RHSA-2026:48151 |
| Red Hat AMQ Broker 7.13.6 | Fixed | RHSA-2026:66545 |
| Red Hat AMQ Broker 7.14.1 | Fixed | RHSA-2026:66488 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:34374 |
| Red Hat Developer Hub 1.10 | Fixed | RHSA-2026:36754 |
| Red Hat Developer Hub 1.9 | Fixed | RHSA-2026:33574 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:29197 |
| Red Hat Enterprise Linux Extensions Channel (v. 10) | Fixed | RHSA-2026:57590 |
| Red Hat Hardened Images | Fixed | RHSA-2026:26638, RHSA-2026:26994, RHSA-2026:27171, RHSA-2026:7655 |
| Red Hat Migration Toolkit 1.8 | Fixed | RHSA-2026:41928 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:65126 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:73987 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:60520, RHSA-2026:84734 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:44235 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:44263 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:40792, RHSA-2026:44267 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:40768, RHSA-2026:48693 |
| Red Hat OpenShift Dev Spaces 3.29 | Fixed | RHSA-2026:36820 |
| Red Hat Openshift Data Foundation 4.18 | Fixed | RHSA-2026:56431 |
| Red Hat Openshift Data Foundation 4.19 | Fixed | RHSA-2026:56366 |
| Red Hat Openshift Data Foundation 4.20 | Fixed | RHSA-2026:57013 |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:56928 |
| Red Hat Trusted Artifact Signer 1.3 | Fixed | RHSA-2026:70829 |
| Red Hat Trusted Artifact Signer 1.4 | Fixed | RHSA-2026:37272 |
Not affected: 38 products
- Cryostat 4
- Cryostat 4 on RHEL 9
- Gatekeeper 3
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.6
- Red Hat Build of Keycloak
- Red Hat Developer Hub 1.10
- Red Hat Developer Hub 1.9
- Red Hat Discovery 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat Hardened Images
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Migration Toolkit 1.8
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces 3.29
- Red Hat OpenShift Virtualization 4
- Red Hat Openshift Data Foundation 4.18
- Red Hat Openshift Data Foundation 4.19
- Red Hat Openshift Data Foundation 4.20
- Red Hat Openshift Data Foundation 4.22
- Red Hat Trusted Artifact Signer 1.3
- Red Hat Trusted Artifact Signer 1.4
- Red Hat build of Apache Camel for Spring Boot 4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-45736
- 2026-10-03 Alias added: GHSA-58qx-3vcg-4xpx
- 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Affected versions changed · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
References
More websockets Ws vulnerabilities
- TI-2026-36049 ws: Memory exhaustion DoS from tiny fragments and data chunks CVSS 3.1HIGH 7.5
- TI-2016-08584 Uncontrolled resource consumption in HackerOne ws node module CVSS 3.0HIGH 7.5
- TI-2016-08560 Memory corruption in HackerOne ws node module CVSS 3.0HIGH 7.5
- TI-2021-12308 ReDoS in Sec-Websocket-Protocol header CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-45736 · CVE Program
- CVE-2026-45736 · NVD
- FIRST EPSS
- GHSA-58qx-3vcg-4xpx · GitHub Advisory Database · CC BY 4.0
- CVE-2026-45736 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences