ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`

🗓️ 11 Apr 2026 00:49:50Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 2 Views

Flaw in ws allows uninitialized memory disclosure when websocket.close() uses a TypedArray as the reason.

Reporter	Title	Published	Views	Family All 93
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Manage Component uses ws-8.17.1 in inspections application which is vulnerable to CVE-2026-45736	26 Jun 202610:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs	2 Jul 202610:42	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in ws	1 Jul 202614:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench	25 Jun 202616:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules (CVE-2026-45736, CVE-2026-45149, CVE-2026-3449 & CVE-2026-8723)	29 Jun 202607:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty	10 Jul 202612:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	13 Jul 202616:03	–	ibm
ATTACKERKB	CVE-2026-45736	15 May 202614:53	–	attackerkb
BDU FSTEC	The vulnerability of the Node.js WebSocket library, related to the use of uninitialized resources, allows attackers to gain unauthorized access to protected information.	7 Jul 202600:00	–	bdu_fstec
Atlassian	RCE (Remote Code Execution) ws Dependency in Bitbucket Data Center	15 Jul 202604:30	–	atlassian

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	any	aarch64	yarnpkg	1.22.22-18.1.hum1	yarnpkg-1.22.22-18.1.hum1.aarch64.rpm
Red Hat Hardened Images	any	x86_64	yarnpkg	1.22.22-18.1.hum1	yarnpkg-1.22.22-18.1.hum1.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-45736
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086
github	www.github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-45736
cve	www.cve.org/CVERecord

26 Jul 2026 06:14Current

6Medium risk

Vulners AI Score6

CVSS 3.17.5

EPSS0.00745

SSVC

websocket uninitialized memory memory disclosure typed array close reason vulnerability