CVE-2026-45736 ws: Uninitialized memory disclosure
An attacker can disclose uninitialized memory by passing a TypedArray as the reason argument to websocket.close() in the ws library.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45736?
CVE-2026-45736 is a medium-severity vulnerability in websockets ws, published on 15 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.
Which versions are affected by CVE-2026-45736?
2 open source packages ship an affected version, including ws. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ws npm | From 8.0.0 | 8.20.1 |
ws npm | From 8.0.0 | 8.20.1 |
Linux distribution packages (1)
zcode openSUSE:Tumbleweed | All versions | 3.14.3-1.1 |
Products include Ws Project Ws.
How do I fix CVE-2026-45736?
Upgrade ws to 8.20.1 or later.
Is CVE-2026-45736 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45736 exists.
Other vulnerabilities in websockets ws
Sources
Also known as CLEANSTART-2026-OF42288, CLSA-2026-1784596293, CLSA-2026-1784596324, CLSA-2026-1790200934, CLSA-2026-1790202672, CLSA-2026-1790413013 and 37 more.