CVE-2026-45736 — MEDIUM (4.4)

Q: How severe is CVE-2026-45736?

CVE-2026-45736 has been rated MEDIUM with a CVSS base score of 4.4/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-45736?

Check the references section above for vendor advisories and patch information. Affected products include: Ws Project Ws.

Vulnerability Description

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

CVSS Score

4.4

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Ws Project	Ws	>= 8.0.0, < 8.20.1

Related Weaknesses (CWE)

CWE-908

References

https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086Patch
https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpxExploitPatchVendor Advisory
https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpxExploitPatchVendor Advisory

FAQ

What is CVE-2026-45736?

CVE-2026-45736 is a vulnerability with a CVSS score of 4.4 (MEDIUM). ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the ...

How severe is CVE-2026-45736?

CVE-2026-45736 has been rated MEDIUM with a CVSS base score of 4.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-45736?

Check the references section above for vendor advisories and patch information. Affected products include: Ws Project Ws.