Bug 2477914 (CVE-2026-45736) - CVE-2026-45736 ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`
Summary: CVE-2026-45736 ws: ws: Uninitialized memory disclosure via `websocket.close()...
Keywords:
Status: NEW
Alias: CVE-2026-45736
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2490629 2490631 2490632 2490634 2490635 2490636 2490637 2490639 2490640 2490641 2490645 2490648 2490649 2490652 2490654 2491591 2491594 2491598 2491600 2491603 2490630 2490633 2490638 2490642 2490643 2490644 2490646 2490647 2490650 2490651 2490655 2491595 2491596 2491597 2491599
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-15 16:01 UTC by OSIDB Bzimport
Modified: 2026-08-04 17:36 UTC (History)
143 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:48151 0 None None None 2026-07-29 19:54:06 UTC

Description OSIDB Bzimport 2026-05-15 16:01:18 UTC 
ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.
Comment 4 errata-xmlrpc 2026-07-29 19:53:58 UTC 
This issue has been addressed in the following products:

  Cryostat 4 on RHEL 9

Via RHSA-2026:48151 https://access.redhat.com/errata/RHSA-2026:48151
Note You need to log in before you can comment on or make changes to this bug.