113 matches found
Improper Handling of Length Parameter Inconsistency
Overview Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency through the hybi.js WebSocket frame processing in lib/websocket/driver. An attacker can corrupt how the server parses a message by sending a draft WebSocket frame with a length header...
-tompan-reacttemplate (>=1.0.1, <=1.1.0), 3d-crystal-model (0.1.0) +3504 more potentially affected by CVE-2026-54466 via websocket-driver (>=0.3.5, <=0.7.4)
websocket-driver NPM version =0.3.5, =1.0.1, =0.1.2, =1.0.8, =0.1.0, =0.1.21, =1.0.0, =1.0.5, =0.2.0, =3.4.1, =0.1.1, =0.1.272 - @themis/usescheme 1.1.4 - @ab-task/react-tool-belt 0.1.1 and more Source cves: CVE-2026-54466 Source advisory: OSV:GHSA-XV26-6W52-CPH6...
-tompan-reacttemplate (>=1.0.1, <=1.1.0), 3d-crystal-model (0.1.0) +3504 more potentially affected by CVE-2026-54466 via websocket-driver (>=0.3.5, <=0.7.4)
websocket-driver NPM version =0.3.5, =1.0.1, =0.1.2, =1.0.8, =0.1.0, =0.1.21, =1.0.0, =1.0.5, =0.2.0, =3.4.1, =0.1.1, =0.1.272 - @themis/usescheme 1.1.4 - @ab-task/react-tool-belt 0.1.1 and more Source cves: CVE-2026-54466 Source advisory: SNYK:JS-WEBSOCKETDRIVER-17987994...
NPM: websocket-driver: Message corruption via abuse of protocol length headers
NPM: websocket-driver: Message corruption via abuse of protocol length headers vulnerability discovered by ? in WordPress Npm websocket-driver versions 0.7.5...
-tompan-reacttemplate (>=1.0.1, <=1.1.0), 3d-crystal-model (0.1.0) +3504 more potentially affected by CVE-2026-54466 via websocket-driver (>=0.3.5, <=0.7.4)
websocket-driver NPM version =0.3.5, =1.0.1, =0.1.2, =1.0.8, =0.1.0, =0.1.21, =1.0.0, =1.0.5, =0.2.0, =3.4.1, =0.1.1, =0.1.272 - @themis/usescheme 1.1.4 - @ab-task/react-tool-belt 0.1.1 and more Source cves: CVE-2026-54466 Source advisory: GHSA-XV26-6W52-CPH6...
GHSA-8J3G-F24P-4MPW websocket-driver: Memory exhaustion in HTTP header parser
Impact If this library is used to implement a WebSocket server on top of a TCP server rather than an HTTP server or framework using the WebSocket::Driver.server method, or, if it is used to complement a WebSocket client, then a peer can make a single connection consume an unbounded amount of memo...
websocket-driver: Memory exhaustion in HTTP header parser
Impact If this library is used to implement a WebSocket server on top of a TCP server rather than an HTTP server or framework using the WebSocket::Driver.server method, or, if it is used to complement a WebSocket client, then a peer can make a single connection consume an unbounded amount of memo...
PT-2026-60380
Name of the Vulnerable Software and Affected Versions websocket-driver versions prior to 0.8.1 Description When used to implement a WebSocket server on top of a TCP server via the WebSocket::Driver.server method or to complement a WebSocket client, the software is susceptible to memory exhaustion...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the handling of protocol length headers in draft versions of the WebSocket protocol. An attacker can cause excessive memory consumption by sending a continuous sequence of byt...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the permessage-deflate extension. An attacker can cause the application to process messages that exceed the intended resource limits by sending compressed messages that, when...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the HTTP header parser process. An attacker can cause excessive memory consumption by sending an HTTP request or response with an unbounded number of headers, leading to memory...
Uncaught Exception
Overview Affected versions of this package are vulnerable to Uncaught Exception in the server process when handling a malformed Host header. An attacker can cause the server to crash by sending a specially crafted Host header that is not a valid host:port string, resulting in an uncaught exceptio...
