The vulnerability of the Node.js WebSocket library, related to the use of uninitialized resources, allows attackers to gain unauthorized access to protected information.

🗓️ 07 Jul 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Node.js WebSocket library has a vulnerability from uninitialized resources enabling unauthorized access to protected information.

Reporter	Title	Published	Views	Family All 96
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Manage Component uses ws-8.17.1 in inspections application which is vulnerable to CVE-2026-45736	26 Jun 202610:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs	2 Jul 202610:42	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in ws	1 Jul 202614:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench	25 Jun 202616:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules (CVE-2026-45736, CVE-2026-45149, CVE-2026-3449 & CVE-2026-8723)	29 Jun 202607:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty	10 Jul 202612:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	13 Jul 202616:03	–	ibm
ATTACKERKB	CVE-2026-45736	15 May 202614:53	–	attackerkb
Atlassian	RCE (Remote Code Execution) ws Dependency in Bitbucket Data Center	15 Jul 202604:30	–	atlassian
Atlassian	HTTP Request Smuggling ws Dependency in Confluence Data Center	22 May 202622:30	–	atlassian

Vulners

Node

red_hat openshift_container_platformMatch4

red_hat red_hat_quayMatch3

red_hat red_hat_amq_brokerMatch7

red_hat red_hat_data_gridMatch8

red_hat red_hat_openshift_dataMatch4

red_hat red_hat_satelliteMatch6

red_hat red_hat_openshift_virtualizationMatch4

red_hat red_hat_ansible_automation_platformMatch2

red_hat cryostatMatch4

red_hat red_hat_connectivity_linkMatch1

red_hat discoveryMatch2

red_hat red_hat_ansible_automation_platformMatch2.6

red_hat ansible_automation_platformMatch2

red_hat gatekeeperMatch3

red_hat self-service_automation_portalMatch2

red_hat red_hat_developer_hubMatch1.9

npm,websocketRange8.0.0–8.20.1

red_hat red_hat_enterprise_linuxMatch8

red_hat red_hat_enterprise_linuxMatch9

red_hat red_hat_enterprise_linuxMatch10

red_hat red_hat_enterprise_linux_aiMatch3

Source	Link
github	www.github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086
github	www.github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx
lk	www.lk.astralinux.ru/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-45736
access	www.access.redhat.com/security/cve/cve-2026-45736
web	www.web.nvd.nist.gov/view/vuln/detail

23 Jul 2026 00:00Current

6Medium risk

Vulners AI Score6

CVSS 34.4

CVSS 24.6

EPSS0.00745