CVE-2026-48779 ws: Memory exhaustion DoS from tiny fragments and data chunks
Attackers can cause memory exhaustion and process termination by sending tiny WebSocket fragments, requiring library upgrades to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48779?
CVE-2026-48779 is a high-severity denial of service vulnerability in websockets ws, published on 16 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.
Which versions are affected by CVE-2026-48779?
8 open source packages ship an affected version, including ws. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ws npm | From 1.1.0 | 5.2.5 |
ws npm | From 1.1.0 | 5.2.5 |
ws npm | From 6.0.0 | 6.2.4 |
ws npm | From 6.0.0 | 6.2.4 |
ws npm | From 7.0.0 | 7.5.11 |
ws npm | From 7.0.0 | 7.5.11 |
2 more packages
ws npm | From 8.0.0 | 8.21.0 |
ws npm | From 8.0.0 | 8.21.0 |
Linux distribution packages (5)
python-bqplot openSUSE:Tumbleweed | All versions | 0.13.1-15.1 |
python-ipympl openSUSE:Tumbleweed | All versions | 0.10.0-18.1 |
python-jupyter-ydoc openSUSE:Tumbleweed | All versions | 3.5.0-1.1 |
python-jupyterlab-templates openSUSE:Tumbleweed | All versions | 0.5.3-2.1 |
python-nbclassic openSUSE:Tumbleweed | All versions | 1.3.3-2.1 |
Products include Ws Project Ws.
How do I fix CVE-2026-48779?
Upgrade ws to a fixed version for your release line: 5.2.5, 6.2.4, 7.5.11 or 8.21.0.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-48779 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48779 exists.
Other vulnerabilities in websockets ws
Sources
Also known as AZL-91415, CLEANSTART-2026-PK38447, CLSA-2026-1784769503, CLSA-2026-1784769533, CLSA-2026-1784769619, CLSA-2026-1784856221 and 61 more.