CVE-2026-48779 affects the ws WebSocket client and server library for Node.js. The vulnerability arises from the ability of a remote attacker to send a large number of exceptionally small WebSocket fragments and data chunks. This forces the affected system to allocate and maintain structural wrappers that consume significantly more memory than the documented message-size limit, resulting in process termination due to out-of-memory conditions. The flaw is classified under CWE-400 (Uncontrolled Resource Consumption), CWE-770, and CWE-1050. The vulnerability affects multiple version ranges: >=1.1.0 <5.2.5, >=6.0.0 <6.2.4, >=7.0.0 <7.5.11, and >=8.0.0 <8.21.0. Fixes have been released in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0. Red Hat's advisory confirms the impact and notes that no suitable mitigation other than upgrading is currently available.

Successful exploitation results in a denial of service condition by exhausting memory resources on the affected system, causing the ws process to terminate. This disrupts WebSocket communication services relying on the ws library, potentially impacting availability. There is no impact on confidentiality or integrity. The CVSS v3.1 score is 7.5 (High), reflecting a network attack vector with low complexity and no required privileges or user interaction.

A fix is available in ws versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0. Users should upgrade to these or later versions to remediate the vulnerability. Red Hat advisories indicate that no effective mitigation other than upgrading currently meets their criteria for ease of use, applicability, and stability. Therefore, upgrading is the recommended remediation.