More information about this security flaw is available in the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=2292777 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
websocket-js is only used in obs-cef (and Chromium in general) for the devtools frontend, as a client. Since this CVE is in the server side which is not used in production, it is not relevant to this package.
For verification, grep the source tree for "WebSocketServer". The only hits in JS code are within websocket-js itself, and in `third_party/devtools-frontend/src/scripts/hosted_mode/server.js` which is a development server for local testing, not used in the built package.