The websocket-driver package contains a vulnerability (CVE-2026-54466) related to the handling of length headers in WebSocket protocol draft frames. The length header can be encoded as a sequence of bytes with the high bit set, allowing an attacker to send an indefinite sequence of bytes (0x80 or above) that causes the server to parse an ever-growing integer. Due to JavaScript's 64-bit floating point number precision limits, this integer eventually loses precision, resulting in incorrect parsing of the message payload. This vulnerability is classified under CWE-130 (Improper Handling of Length Parameter). The issue is fixed in websocket-driver version 0.7.5 by rejecting messages with length headers exceeding the maximum allowed length.

An attacker can exploit this vulnerability to cause message corruption by sending specially crafted WebSocket frames with length headers that cause the server to misinterpret the payload length. This can lead to incorrect processing of messages, potentially disrupting communication or causing application-level errors. The vulnerability does not require authentication and can be triggered remotely by a network attacker. There are no known exploits in the wild at this time.

Upgrade websocket-driver to version 0.7.5 or later, where the vulnerability is patched by rejecting messages with length headers exceeding the configured maximum message length. No known workarounds exist. Users should apply this official fix promptly to prevent exploitation.