CVE-2026-54466 Details
Description
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer in lib/websocket/driver/draft75.js; because JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly. This issue is fixed in version 0.7.5.
A vulnerability in the WebSocket-Driver package, prior to version 0.7.5, allows for message corruption by exploiting the length header in draft versions of the WebSocket protocol. This header can encode large integers as byte sequences with the high bit set. A client can send a continuous stream of bytes with values 0x80 or above, causing the server to convert these bytes into an increasingly large integer. Due to JavaScript's handling of numbers as 64-bit floating point values, this integer will eventually lose precision, leading to incorrect parsing of subsequent payloads.
Users are advised to upgrade to WebSocket-Driver version 0.7.5 or later, where this issue has been fixed by implementing a maximum length check for the length header.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-130 | Improper Handling of Length Parameter Inconsistency | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| faye websocket-driver | < 0.7.5 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |