CVE-2026-54466 websocket-driver: Message corruption via abuse of protocol length headers
An attacker can cause message corruption and potential service disruption by sending malformed WebSocket frames with excessively large length headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54466?
CVE-2026-54466 is a critical denial of service vulnerability in faye websocket-driver-node, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer in lib/websocket/driver/draft75.js; because JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly. This issue is fixed in version 0.7.5.
Weakness: CWE-130
Which versions are affected by CVE-2026-54466?
2 open source packages ship an affected version, including websocket-driver. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
websocket-driver npm | All versions | 0.7.5 |
websocket-driver npm | All versions | 0.7.5 |
Products include Faye Websocket-Driver.
How do I fix CVE-2026-54466?
Upgrade websocket-driver to 0.7.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-54466 being exploited?
There is no known exploitation of CVE-2026-54466 in the wild and no public exploit code.
Other vulnerabilities in faye websocket-driver-node
Sources
Also known as CLEANSTART-2026-BN70978, CLEANSTART-2026-MI43337, CLEANSTART-2026-SA59159, DEBIAN-CVE-2026-54466, GHSA-xv26-6w52-cph6, MINI-343j-83v7-w4rf and 10 more.