How severe is CVE-2026-45736?

CVE-2026-45736 has a CVSS 3.x base score of 4.4, rated medium severity. It is exploitable over network with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2026-45736 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (49th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-45736?

CVE-2026-45736 affects Ws Project Ws. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-45736?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-45736 have an EU (EUVD) identifier?

Yes. CVE-2026-45736 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-30543.

When was CVE-2026-45736 published?

CVE-2026-45736 was published on 2026-05-15 and last updated on 2026-07-02.

CVE-2026-45736

CVE-2026-45736 is a medium-severity vulnerability in Ws Project Ws with a CVSS 3.x base score of 4.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-908.

Key facts

Severity: Medium (CVSS 3.x base score 4.4)
EPSS exploit prediction: 1% (49th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-30543
Weakness: CWE-908
Affected product: Ws Project Ws
Published: 2026-05-15
Last modified: 2026-07-02

Description

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

Frequently asked questions

What is CVE-2026-45736?: ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.
How severe is CVE-2026-45736?: CVE-2026-45736 has a CVSS 3.x base score of 4.4, rated medium severity. It is exploitable over network with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2026-45736 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (49th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-45736?: CVE-2026-45736 affects Ws Project Ws. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-45736?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-45736 have an EU (EUVD) identifier?: Yes. CVE-2026-45736 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-30543.
When was CVE-2026-45736 published?: CVE-2026-45736 was published on 2026-05-15 and last updated on 2026-07-02.

References

Affected products (1)

cpe:2.3:a:ws_project:ws:*:*:*:*:*:node.js:*:*

More vulnerabilities in Ws Project Ws

CVE-2026-48779 — High (CVSS 7.5): ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5,…
CVE-2016-10542 — High (CVSS 7.5): ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date…
CVE-2016-10518 — High (CVSS 7.5): A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate…
CVE-2021-32640 — Medium (CVSS 5.3): ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the…

All CVEs affecting Ws Project Ws →

Other CWE-908 (Use of Uninitialized Resource) vulnerabilities

CVE-2025-1942 — Critical (CVSS 9.8): When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated…
CVE-2024-47540 — Critical (CVSS 9.8): GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable…
CVE-2024-32611 — Critical (CVSS 9.8): HDF5 Library through 1.14.3 may use an uninitialized value in H5A__attr_release_table in H5Aint.c.
CVE-2023-24941 — Critical (CVSS 9.8): Windows Network File System Remote Code Execution Vulnerability
CVE-2022-26437 — Critical (CVSS 9.8): In httpclient, there is a possible out of bounds write due to uninitialized data. This could lead to remote escalation…
CVE-2021-45703 — Critical (CVSS 9.8): An issue was discovered in the tectonic_xdv crate before 0.1.12 for Rust. XdvParser::<T>::process may read from…

Browse all CWE-908 (Use of Uninitialized Resource) vulnerabilities →