Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

9 records

Vendor: faye Clear all filters
TI-2026-39321 CVE-2026-54464 · GHSA-33ph-fccm-39pj

websocket-driver: Resource limit bypass via message compression

Priority LOW 34

### Impact If this library is used in tandem with the `permessage-deflate` extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00445 Published 2026-07-17 Partial fix · 0.8.1 CWE-770
TI-2020-11906 CVE-2020-15133 · GHSA-2v5c-755p-p4gv

Missing TLS certificate verification in Faye Websocket

Priority LOW 39

In faye-websocket before version 0.11.0, there is a lack of certification validation in TLS handshakes.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.00918 Published 2020-07-31 Fixed in 0.11.0 CWE-295
TI-2020-11907 CVE-2020-15134 · GHSA-3q49-h8f9-9fr9

Missing TLS certificate verification in Faye

Priority LOW 39

Faye before version 1.4.0, there is a lack of certification validation in TLS handshakes.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.00864 Published 2020-07-31 Fixed in 1.4.0 CWE-295
TI-2020-08894 CVE-2020-11020 · GHSA-qpg4-4w7w-2mq5

Authentication and extension bypass in Faye

Priority MEDIUM 45

Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01573 Published 2020-04-29 Fixed in 1.0.4, 1.1.3 +1 CWE-287