CVE-2026-45736 is a vulnerability in the ws WebSocket client and server library for Node.js. Specifically, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This can result in sensitive information leakage from uninitialized memory areas. The issue is tracked under CWE-908 (Use of Uninitialized Resource) and CWE-824 (Access of Uninitialized Pointer). The vulnerability affects all versions prior to 8.20.1 and has been fixed in 8.20.1. The CVSS v3 base score is 7.5 (High) according to Red Hat's assessment, indicating a network attack vector with low complexity and no required privileges or user interaction, resulting in high confidentiality impact but no integrity or availability impact. No known exploits in the wild have been reported. Red Hat has released advisories and errata addressing this vulnerability.

An attacker who can cause the websocket.close() function to be called with a TypedArray reason argument may be able to read sensitive information from uninitialized memory. This confidentiality breach does not affect integrity or availability. The vulnerability requires network access but no privileges or user interaction. There are no known active exploits in the wild at this time.

A fix is available in ws version 8.20.1. Users and vendors should upgrade to version 8.20.1 or later to remediate this vulnerability. Red Hat has released security advisories and errata that include this fix for affected products. No additional mitigations are specified or required beyond applying the official update.