Description
ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| websockets | ws | >= 1.1.0, < 5.2.5, >= 6.0.0, < 6.2.4, >= 7.0.0, < 7.5.11, >= 8.0.0, < 8.21.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-ws | 8.21.0+~cs14.19.1-1 | — |
| Debian 13 | node-ws | No fix yet | — |
| Debian 12 | node-ws | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-ws | No fix yet | — |
| Ubuntu 26.04 LTS | node-ws | No fix yet | — |
| Ubuntu 25.10 | node-ws | No fix yet | — |
| Ubuntu 24.04 LTS | node-ws | No fix yet | — |
| Ubuntu 22.04 LTS | node-ws | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-ws | No fix yet | — |
| Ubuntu 18.04 LTS | node-ws | No fix yet | — |
| Ubuntu 16.04 LTS | node-ws | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | rh-podman-desktop | 1.1.2-1.el10_2 | RHSA-2026:57590 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | agama-integration-tests | 1785848065.5562c7c-4.1 | openSUSE-SU-2026:11452-1 |
| openSUSE Tumbleweed | heroic-games-launcher | 2.22.0-3.1 | openSUSE-SU-2026:11145-1 |
| openSUSE Tumbleweed | kimi-code | 0.41.0-1.1 | openSUSE-SU-2026:11705-1 |
| openSUSE Tumbleweed | python-bqplot | 0.13.1-15.1 | openSUSE-SU-2026:11397-1 |
| openSUSE Tumbleweed | python-ipympl | 0.10.0-18.1 | openSUSE-SU-2026:11354-1 |
| openSUSE Tumbleweed | python-jupyter-ydoc | 3.5.0-1.1 | openSUSE-SU-2026:11137-1 |
| openSUSE Tumbleweed | python-jupyterlab-templates | 0.5.3-2.1 | openSUSE-SU-2026:11138-1 |
| openSUSE Tumbleweed | python-nbclassic | 1.3.3-2.1 | openSUSE-SU-2026:11123-1 |
| openSUSE Leap 16.0 | kimi-code | 0.42.0-bp160.1.1 | openSUSE-SU-2026:21849-1 |
| openSUSE Leap 16.0 | python-pydata-sphinx-theme | 0.16.1-bp160.2.1 | openSUSE-SU-2026:21173-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | js-jquery | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | code-server | 4.124.2-r0 | — |
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r31 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
| Wolfi rolling | langfuse-3-compat | 3.225.7-r6 | — |
| Wolfi rolling | langfuse-3-worker | 3.188.0-r0 | — |
| Wolfi rolling | opensearch-dashboards-3-dashboards-reporting +1 | 3.7.0-r2 | — |
| Wolfi rolling | py3.10-jupyterlab +3 | 4.6.1-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | ws | >= 1.1.0, < 5.2.5 | 5.2.5 | GHSA-96hv-2xvq-fx4p |
| npm | ws | >= 6.0.0, < 6.2.4 | 6.2.4 | GHSA-96hv-2xvq-fx4p |
| npm | ws | >= 7.0.0, < 7.5.11 | 7.5.11 | GHSA-96hv-2xvq-fx4p |
| npm | ws | >= 8.0.0, < 8.21.0 | 8.21.0 | GHSA-96hv-2xvq-fx4p |
Advisories 14
- WID-SEC-2026-2923 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- RHSA-2026:57590 Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-2460 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2026
- openSUSE-SU-2026:21849-1 Security update for kimi-code SUSE / openSUSE Security Updates · Sep 15, 2026
- openSUSE-SU-2026:11705-1 kimi-code-0.41.0-1.1 on GA media SUSE / openSUSE Security Updates · Sep 8, 2026
- NCSC-2026-0325 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Aug 24, 2026
- openSUSE-SU-2026:11452-1 agama-integration-tests-1785848065.5562c7c-4.1 on GA media SUSE / openSUSE Security Updates · Aug 6, 2026
- openSUSE-SU-2026:11397-1 jupyter-bqplot-jupyterlab-0.5.46-15.1 on GA media SUSE / openSUSE Security Updates · Jul 29, 2026
- openSUSE-SU-2026:11354-1 jupyter-matplotlib-0.11.7-18.1 on GA media SUSE / openSUSE Security Updates · Jul 24, 2026
- openSUSE-SU-2026:21173-1 Security update for python-pydata-sphinx-theme SUSE / openSUSE Security Updates · Jun 30, 2026
- openSUSE-SU-2026:11145-1 heroic-games-launcher-2.22.0-3.1 on GA media SUSE / openSUSE Security Updates · Jun 30, 2026
- openSUSE-SU-2026:11138-1 jupyter-jupyterlab-templates-0.5.3-2.1 on GA media SUSE / openSUSE Security Updates · Jun 29, 2026
- openSUSE-SU-2026:11137-1 python311-jupyter-ydoc-3.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Jun 29, 2026
- openSUSE-SU-2026:11123-1 jupyter-nbclassic-1.3.3-2.1 on GA media SUSE / openSUSE Security Updates · Jun 26, 2026
References
- https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p
- https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7
- https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53
- https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94
- https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8