CVE-2026-62389
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Summary
ws before 8.21.1 contains a memory exhaustion vulnerability in lib/receiver.js where the fragment guard only triggers when fragment count reaches maxFragments, allowing attackers to exhaust memory by sending incomplete fragmented WebSocket messages. Attackers can send a text frame with FIN=0 followed by continuation frames without completing the sequence, causing each fragment to be stored as a separate Buffer object with significant overhead, enabling denial of service through heap exhaustion.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| websockets | ws | 0 < 8.21.1 | affected |
Weaknesses
- CWE-770: Allocation of Resources Without Limits or Throttling
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: yes
- Technical Impact: partial
References
- https://github.com/websockets/ws/issues/2331
- https://github.com/websockets/ws/releases/tag/8.21.1
- https://github.com/websockets/ws/commit/f197ac65140920bdcecdab74bfc69c2d7858e55d
- https://www.vulncheck.com/advisories/ws-default-maxfragments-allows-memory-exhaustion-dos
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.