CVE-2026-45736

PoC —

CVSS 3.1

7.5 high

EPSS

<1%p53

Published

May 15, 2026 (May 15, 2026)

Modified

Sep 11, 2026

Description

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

Vendors: ws project
Products: ws
Weakness: CWE-908, CWE-824
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.