CVE-2026-48779
A public proof of concept exists; no exploitation attested.
- Published2026-06-17
- Fixed in8.21.0 · 7.5.11 · 6.2.4 · 5.2.5
- WeaknessCWE-1050 · CWE-400 · CWE-770
Am I affected?
Debian, Ubuntu or Red Hat sometimes backport a fix without changing the upstream version number: such a version reads « to verify », never « affected ».With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.
Description
ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.
Timeline
dates in UTC- 2026-06-1713:20CVE publishedNVD
Observed activity
isMalicious corpus · updated 2026-10-23 15:37 UTCBlock these indicators
- Firewall list (EDL, text): https://api.ismalicious.com/edl/cve/CVE-2026-48779?format=txt
- CSV export: https://api.ismalicious.com/edl/cve/CVE-2026-48779?format=csv
- TAXII collection of exploited CVEs
- The EDL and CSV take an API key on the Pro plan.
Versions per branch
NVD · OSV| Branch | Affected | Fixed in | Source |
|---|---|---|---|
| 8.x | ≥ 8.0.0, < 8.21.0 | 8.21.0 | NVD · OSV |
| 7.x | ≥ 7.0.0, < 7.5.11 | 7.5.11 | NVD |
| 6.x | ≥ 6.0.0, < 6.2.4 | 6.2.4 | NVD |
| 5.2 | ≥ 1.1.0, < 5.2.5 | 5.2.5 | NVD |
as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.
Distribution builds and vendor advisories
Packages from OSV.dev and products from the vendors' CSAF advisories.
version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.
Vendor advisories
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments
workload-availability/node-healthcheck-must-gather-rhel9 as a component of Node HealthCheck Operator · workload-availability/node-healthcheck-operator-bundle as a component of Node HealthCheck Operator · workload-availability/node-healthcheck-rhel9-operator as a component of Node HealthCheck Operator · +36 more
Red Hat Security Advisory: RHOAI 3.4.5 - Red Hat OpenShift AI
Red Hat Security Advisory: RHOAI 3.3.7 - Red Hat OpenShift AI
Red Hat Security Advisory: RHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release
Red Hat Security Advisory: Red Hat AMQ Broker 7.13.6 release and security update
Red Hat Security Advisory: Red Hat AMQ Broker 7.14.1 release and security update
22 more advisories
Fix
- Update Ws project ws to 8.21.0 · 7.5.11 · 6.2.4 · 5.2.5
- Vendor fix Red Hat Product Security RHSA-2026:84734 · 4 productsFor Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
- Vendor fix Red Hat Product Security RHSA-2026:73987 · 4 productsFor Red Hat OpenShift AI 3.3.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
- Vendor fix Red Hat Product Security RHSA-2026:70829 · 1 productRed Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev Platform Engineers, Software Develop…
- Vendor fix Red Hat Product Security RHSA-2026:66545 · 1 productBefore applying the update, back up your existing installation, including all applications, configuration files, databases and database settings. The References section of this erratum contains a download link (you must log in to download the update).
- Vendor fix Red Hat Product Security RHSA-2026:65126 · 4 productsFor Red Hat OpenShift AI 2.25.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
- Vendor fix Red Hat Product Security RHSA-2026:60520 · 28 productsFor Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
Advisories and patches
- github.comPatch
- github.comPatch
- github.comPatch
- github.comPatch
- github.comMitigation · Patch · Vendor Advisory
Detection
- Nuclei template
- none so far ProjectDiscovery
- Exploit-DB
- no entry Exploit-DB
- Proof-of-concept repositories
- none listed PoC-in-GitHub
Sources
- NVDCVE recordread 2026-10-23
- CISA-ADPSSVC decisionpoc2026-06-17
- OpenCVESSVC decisionpoc—
- CNACVSS 3.17.5read 2026-10-23
- CNAweakness (CWE)CWE-1050, CWE-400, CWE-770read 2026-10-23
- FIRST EPSSEPSS score0.9 %2026-10-22
- OSVaffected packages—
- Microsoft MSRCadvisory—
Technical details
- CVSS v3 Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Published
- 2026-06-17
- Last Modified
- 2026-09-11
- NVD status
- Modified
- MSRC Title
- ws: Memory exhaustion DoS from tiny fragments and data chunks
Frequently asked questions
What is CVE-2026-48779?
Is CVE-2026-48779 actively exploited?
What is the CVSS score for CVE-2026-48779?
Running ws? Hear about its next vulnerability
Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».
No credit card required · No monthly cap on website lookups · 250 API requests/month
Go further
- Following what attackers exploit right now? The CISA KEV additions of the month, with their patch deadlines.
- Running this software? Vulnerability monitoring alerts you to new vulnerabilities in your products.
Related vulnerabilities
Same product first, then the same vendor advisory and the same publication week.
- CVE-2026-48710KEVsame advisory
- CVE-2025-61726same advisory
- CVE-2026-67325same advisory
- CVE-2026-57967same advisory
- CVE-2026-79657same advisory
- CVE-2026-67323same advisory
- CVE-2026-34480same advisory
- CVE-2026-55969same advisoryApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()