CVE-2026-54490 Details
Description
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.
A resource limit bypass vulnerability has been identified in the websocket-driver library, specifically in versions prior to 0.7.5. When used with the permessage-deflate extension, this library can allow WebSocket servers or clients to accept messages larger than the set maximum size. The vulnerability arises because the size limit is enforced based on the message frames' length headers, which reflect the size of the compressed data rather than the decompressed size. This discrepancy can lead applications to accept unexpectedly large messages, causing them to exceed their intended resource usage.
Users are advised to upgrade to websocket-driver version 0.7.5 or later, where this issue has been fixed by implementing proper length checks after message decompression. No known workarounds exist.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/faye/websocket-driver-node/commit/c55679a5b18251dd0a55d18a0cc6a4fd8822b92f | [email protected] | Source CodeVendor |
| https://github.com/faye/websocket-driver-node/security/advisories/GHSA-mp7j-qc5w-4988 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| faye websocket-driver | < 0.7.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |