-tompan-reacttemplate (>=1.0.1, <=1.1.0), 3d-crystal-model (0.1.0) +3504 more potentially affected by CVE-2026-54490 via websocket-driver (>=0.3.5, <=0.7.4)

websocket-driver NPM version =0.3.5, =1.0.1, =0.1.2, =1.0.8, =0.1.0, =0.1.21, =1.0.0, =1.0.5, =0.2.0, =3.4.1, =0.1.1, =0.1.272 - @themis/usescheme 1.1.4 - @ab-task/react-tool-belt 0.1.1 and more Source cves: CVE-2026-54490 Source advisory: GHSA-MP7J-QC5W-4988...

Allocation of Resources Without Limits or Throttling

Overview websocket-driver is a websocket protocol handler with pluggable I/O. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via message compression through the hybi message handling in lib/websocket/driver/hybi.js. An attacker can make a...

NPM: websocket-driver: Resource limit bypass via message compression

NPM: websocket-driver: Resource limit bypass via message compression vulnerability discovered by ? in WordPress Npm websocket-driver versions 0.7.5...

GHSA-MP7J-QC5W-4988 websocket-driver: Resource limit bypass via message compression

Impact If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the si...

GHSA-XV26-6W52-CPH6 websocket-driver: Message corruption via abuse of protocol length headers

Impact The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server pars...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 3d-crystal-model (0.1.0) +3504 more potentially affected by CVE-2026-54466 via websocket-driver (>=0.3.5, <=0.7.4)

websocket-driver NPM version =0.3.5, =1.0.1, =0.1.2, =1.0.8, =0.1.0, =0.1.21, =1.0.0, =1.0.5, =0.2.0, =3.4.1, =0.1.1, =0.1.272 - @themis/usescheme 1.1.4 - @ab-task/react-tool-belt 0.1.1 and more Source cves: CVE-2026-54466 Source advisory: SNYK:JS-WEBSOCKETDRIVER-17987994...

Improper Handling of Length Parameter Inconsistency

Overview websocket-driver is a websocket protocol handler with pluggable I/O. Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency through the hybi.js WebSocket frame processing in lib/websocket/driver. An attacker can corrupt how the server pars...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 3d-crystal-model (0.1.0) +3504 more potentially affected by CVE-2026-54466 via websocket-driver (>=0.3.5, <=0.7.4)

websocket-driver NPM version =0.3.5, =1.0.1, =0.1.2, =1.0.8, =0.1.0, =0.1.21, =1.0.0, =1.0.5, =0.2.0, =3.4.1, =0.1.1, =0.1.272 - @themis/usescheme 1.1.4 - @ab-task/react-tool-belt 0.1.1 and more Source cves: CVE-2026-54466 Source advisory: OSV:GHSA-XV26-6W52-CPH6...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 3d-crystal-model (0.1.0) +3504 more potentially affected by CVE-2026-54466 via websocket-driver (>=0.3.5, <=0.7.4)

websocket-driver NPM version =0.3.5, =1.0.1, =0.1.2, =1.0.8, =0.1.0, =0.1.21, =1.0.0, =1.0.5, =0.2.0, =3.4.1, =0.1.1, =0.1.272 - @themis/usescheme 1.1.4 - @ab-task/react-tool-belt 0.1.1 and more Source cves: CVE-2026-54466 Source advisory: GHSA-XV26-6W52-CPH6...

Improper Handling of Length Parameter Inconsistency

Overview Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency through the hybi.js WebSocket frame processing in lib/websocket/driver. An attacker can corrupt how the server parses a message by sending a draft WebSocket frame with a length header...

websocket-driver: Message corruption via abuse of protocol length headers

Impact The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server pars...

NPM: websocket-driver: Message corruption via abuse of protocol length headers

NPM: websocket-driver: Message corruption via abuse of protocol length headers vulnerability discovered by ? in WordPress Npm websocket-driver versions 0.7.5...

GHSA-8J3G-F24P-4MPW websocket-driver: Memory exhaustion in HTTP header parser

Impact If this library is used to implement a WebSocket server on top of a TCP server rather than an HTTP server or framework using the WebSocket::Driver.server method, or, if it is used to complement a WebSocket client, then a peer can make a single connection consume an unbounded amount of memo...

websocket-driver: Memory exhaustion in HTTP header parser

Impact If this library is used to implement a WebSocket server on top of a TCP server rather than an HTTP server or framework using the WebSocket::Driver.server method, or, if it is used to complement a WebSocket client, then a peer can make a single connection consume an unbounded amount of memo...

websocket-driver: Resource limit bypass via message compression

Impact If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the si...

GHSA-33PH-FCCM-39PJ websocket-driver: Resource limit bypass via message compression

Impact If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the si...

websocket-driver: Memory exhaustion via abuse of protocol length headers

Impact The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a server or client can make the...

GHSA-GHHP-3QVG-889P websocket-driver: Memory exhaustion via abuse of protocol length headers

Impact The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a server or client can make the...

CVE-2026-54458

CVE-2026-54458 (AVideo YPTSocket XSS) affects WWBN’s AVideo with the YPTSocket plugin (versions prior to 29.0). The vulnerability is an unauthenticated stored DOM XSS: getWebSocket.json.php issues a signed WebSocket token; MessageSQLiteV2::onOpen reads webSocketSelfURI and page_title from the Web...

CVE-2026-54458

WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page th...