CVE-2026-48779 Details

A memory exhaustion denial-of-service vulnerability has been identified in the ws WebSocket client and server for Node.js. This issue affects all versions from 1.1.0 prior to 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0. The vulnerability arises when a peer sends a high volume of exceptionally small fragments and data chunks, with modest network traffic. This forces the remote peer to allocate and hold structural wrappers that consume significantly more memory than the default documented message-size limit. The result is process termination due to out-of-memory conditions.

Users can upgrade to ws versions 5.2.5, 6.2.4, 7.5.11, or 8.21.0 to address this vulnerability. In vulnerable versions, the issue can be mitigated by lowering the maxPayload option if possible.