CVE-2026-48779 affects the ws WebSocket client and server library for Node.js. The vulnerability is an uncontrolled resource consumption (CWE-400) issue where an attacker can send numerous small fragments and data chunks to the remote peer. This forces the remote peer to allocate and hold structural wrappers that consume significantly more memory than the documented message-size limit, resulting in process termination due to out-of-memory (OOM) conditions. The affected versions are >=1.1.0 <5.2.5, >=6.0.0 <6.2.4, >=7.0.0 <7.5.11, and >=8.0.0 <8.21.0. Fixed versions are 5.2.5, 6.2.4, 7.5.11, and 8.21.0. The CVSS 3.1 score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, low complexity, no privileges or user interaction required, no confidentiality or integrity impact, but high impact on availability.

Successful exploitation allows a remote attacker to cause a denial-of-service by exhausting memory resources on the target system running the vulnerable ws versions. This leads to process termination due to out-of-memory conditions, impacting availability. There is no impact on confidentiality or integrity.

A fix is available in ws versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0. Users should upgrade to these or later versions to remediate the vulnerability. Patch status is confirmed by vendor advisories linked from Red Hat. No alternative mitigations are specified.