Skip to main content

Use of Uninitialized Resource

CVE-2026-45736

High
7.5/10

Summary

ws is an open source WebSocket client and server for Node.js. In versions 8.0.0 prior to 8.20.1, the `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray` is passed as the reason argument. This vulnerability is fixed in 8.20.1.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-908 - Use of Uninitialized Resource

The software uses or accesses a resource that has not been initialized.

References

Advisory Timeline

  • Published