InfoSec Signals™
Sign InStart Free
Back to CVE records
High 7.5Published Jun 16, 2026

CVE-2026-48779ws: Memory exhaustion DoS from tiny fragments and data chunks

Updated under an hour ago ()

Does this affect you?

It affects websockets ws and 34 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.

CVSS
7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE)
CWE-400, CWE-770, CWE-1050
Known exploited
Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days)
Not loaded for this CVE
Assigned by
GitHub_M
NVD analysis
Modified
Record last updated
Sep 11, 2026
First seen by InfoSec Signals
Oct 9, 2026

Affected products

Affected products
websockets ws
websockets:ws (from the name)
from 1.1.0, < 5.2.5; from 6.0.0, < 6.2.4; from 7.0.0, < 7.5.11; from 8.0.0, < 8.21.0
CNA record
from 4.2.0-13 not affected
CISA ADP
7.13
CISA ADP
from 0:1.1.2-1.el10_2 not affected
CISA ADP
Red Hat Cluster Observability Operator 1.5.0
redhat:cluster_observability_operator
from 1782840519 not affected
CISA ADP
from 1783448184 not affected
CISA ADP
from 1782166952 not affected
CISA ADP
from 1783690532 not affected
CISA ADP
from 1787801527 not affected
CISA ADP
Red Hat Red Hat Openshift Data Foundation 4.18
redhat:openshift_data_foundation
from 1783676191 not affected; from 1786705347 not affected
CISA ADP
from 1782498475 not affected
CISA ADP
from 1781937133 not affected
CISA ADP
Red Hat Red Hat Trusted Artifact Signer 1.4
redhat:trusted_artifact_signer
from 1783327185 not affected
CISA ADP
Red Hat Gatekeeper 3
redhat:gatekeeper
3
CISA ADP
Red Hat Node HealthCheck Operator
redhat:workload_availability_nhc
0
CISA ADP
Red Hat OpenShift Lightspeed
redhat:openshift_lightspeed
All versions
CISA ADP
Red Hat OpenShift Pipelines
redhat:openshift_pipelines
1
CISA ADP
Red Hat Red Hat Ansible Automation Platform 2
redhat:ansible_automation_platform
2
CISA ADP
4
CISA ADP
4
CISA ADP
Versions not stated
CISA ADP
1
CISA ADP
Red Hat Red Hat Connectivity Link 1
redhat:connectivity_link
1
CISA ADP
Red Hat Red Hat Data Grid 8
redhat:jboss_data_grid
8
CISA ADP
3
CISA ADP
Red Hat Red Hat Fuse 7
redhat:jboss_fuse
7
CISA ADP
1
CISA ADP
Red Hat Red Hat JBoss Enterprise Application Platform 8
redhat:jboss_enterprise_application_platform
8
CISA ADP
Versions not stated
CISA ADP
4
CISA ADP
Red Hat Red Hat OpenShift Virtualization 4
redhat:container_native_virtualization
4
CISA ADP
3
CISA ADP
6
CISA ADP
2
CISA ADP
ws_project ws
ws_project:ws
from 1.1.0 before 5.2.5; from 6.0.0 before 6.2.4; from 7.0.0 before 7.5.11; from 8.0.0 before 8.21.0
NVD

References

  • x-refsource-confirm, exploit, mitigation, patch, vendor-advisory
  • x-refsource-misc, patch
  • x-refsource-misc, patch
  • x-refsource-misc, patch
  • x-refsource-misc, patch

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.