CVE-2026-45736: CWE-908: Use of Uninitialized Resource in websockets ws
ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.
AI Analysis
Technical Summary
CVE-2026-45736 affects the ws WebSocket client and server library for Node.js. Prior to version 8.20.1, the websocket.close() implementation improperly handles a TypedArray passed as the reason argument, leading to potential disclosure of uninitialized memory. This vulnerability is identified as CWE-908 and CWE-824. The issue was resolved in ws version 8.20.1. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. Red Hat advisories confirm the vulnerability and provide updates to mitigate the issue.
Potential Impact
Successful exploitation of this vulnerability could lead to disclosure of uninitialized memory contents, potentially exposing sensitive information. The impact is limited to confidentiality, with no direct integrity or availability effects. The CVSS score of 4.4 reflects a medium severity level. There are no known active exploits in the wild at this time.
Mitigation Recommendations
A fix for this vulnerability is available in ws version 8.20.1. Users and administrators should upgrade to version 8.20.1 or later to remediate this issue. Red Hat has issued security advisories with updates that address this vulnerability. Applying these updates is the recommended remediation. No additional mitigation actions are indicated by the vendor advisories.
CVE-2026-45736: CWE-908: Use of Uninitialized Resource in websockets ws
Description
ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.
CVSS v3.1
Score 4.4medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-45736 affects the ws WebSocket client and server library for Node.js. Prior to version 8.20.1, the websocket.close() implementation improperly handles a TypedArray passed as the reason argument, leading to potential disclosure of uninitialized memory. This vulnerability is identified as CWE-908 and CWE-824. The issue was resolved in ws version 8.20.1. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. Red Hat advisories confirm the vulnerability and provide updates to mitigate the issue.
Potential Impact
Successful exploitation of this vulnerability could lead to disclosure of uninitialized memory contents, potentially exposing sensitive information. The impact is limited to confidentiality, with no direct integrity or availability effects. The CVSS score of 4.4 reflects a medium severity level. There are no known active exploits in the wild at this time.
Mitigation Recommendations
A fix for this vulnerability is available in ws version 8.20.1. Users and administrators should upgrade to version 8.20.1 or later to remediate this issue. Red Hat has issued security advisories with updates that address this vulnerability. Applying these updates is the recommended remediation. No additional mitigation actions are indicated by the vendor advisories.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-13T06:54:34.219Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-45736","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:29197","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:26638","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:26994","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:27171","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:7655","vendor":"Red Hat"}]
Threat ID: 6a073a04ec166c07b05c5b44
Added to database: 05/15/2026, 15:21:40 UTC
Last enriched: 07/31/2026, 14:14:10 UTC
Last updated: 07/31/2026, 20:26:55 UTC
Views: 991
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.