Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: websockets Clear all filters
TI-2026-33473 CVE-2026-45736 · GHSA-58qx-3vcg-4xpx

ws: Uninitialized memory disclosure

Priority HIGH 66

ws is an open source WebSocket client and server for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00745 Published 2026-05-15 Partial fix · 8.20.1 CWE-908
TI-2021-12308 CVE-2021-32640 · GHSA-6fc8-4gx4-v693

ReDoS in Sec-Websocket-Protocol header

Priority LOW 29

ws is an open source WebSocket client and server library for Node.js.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02821 Published 2021-05-25 Partial fix · 7.4.6, 6.2.2 +1 CWE-400
TI-2016-08584 CVE-2016-10542 · GHSA-6663-c963-2gqg

Uncontrolled resource consumption in HackerOne ws node module

Priority MEDIUM 43

ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455".

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.07424 Published 2018-05-31 Fixed in 1.1.1 CWE-400
TI-2016-08560 CVE-2016-10518 · GHSA-2mhh-w6q8-5hxw

Memory corruption in HackerOne ws node module

Priority LOW 37

A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01984 Published 2018-05-31 Fixed in 1.0.1 CWE-201