GHSA-96hv-2xvq-fx4p · Severity: high · Ecosystem: npm — ws: Memory exhaustion DoS from tiny fragments and data chunks
ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.
Conclusion & alert: CVE-2026-48779 is rated High Exploit Risk (63.1/100): CVSS High severity, with medium exploitation likelihood (EPSS 0.78%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-07-01 | 0.73% | 0.78% | +0.06% |
| 2 | 2026-06-30 | 0.52% | 0.73% | +0.20% |
| 3 | 2026-06-23 | — | 0.52% | — |
Full EPSS history (6 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | [email protected] |
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c |
GHSA-96hv-2xvq-fx4p · Severity: high · Ecosystem: npm — ws: Memory exhaustion DoS from tiny fragments and data chunks
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2026-48779 not yet assigned priority: Debian including 1 source packages (node-ws), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): open 3, resolved 2. | https://security-tracker.debian.org/tracker/CVE-2026-48779 |
suse
|
medium | CVE-2026-48779 severity moderate: SUSE including 40 source package names (corepack22, corepack24, …), 139 product×package rows across 19 product lines (SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS, SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS, … (19 product lines)): Known Not Affected 139. | https://www.suse.com/security/cve/CVE-2026-48779/ |
ubuntu
|
medium | CVE-2026-48779 medium priority: Ubuntu including 1 source packages (node-ws), 7 status rows across 7 suites (bionic, focal, jammy, noble, questing, resolute, upstream): needs-triage 7. | https://ubuntu.com/security/CVE-2026-48779 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| ws_project | ws | >= 1.1.0, < 5.2.5 | cpe:2.3:a:ws_project:ws:*:*:*:*:*:node.js:*:* |
| ws_project | ws | >= 6.0.0, < 6.2.4 | cpe:2.3:a:ws_project:ws:*:*:*:*:*:node.js:*:* |
| ws_project | ws | >= 7.0.0, < 7.5.11 | cpe:2.3:a:ws_project:ws:*:*:*:*:*:node.js:*:* |
| ws_project | ws | >= 8.0.0, < 8.21.0 | cpe:2.3:a:ws_project:ws:*:*:*:*:*:node.js:*:* |