CVE-2026-48779: ws WebSocket Memory Exhaustion DoS – Patch Guidance

Technical summary

CVE-2026-48779 is a memory exhaustion denial-of-service flaw in the ws WebSocket library (Node.js). Affected versions include 1.1.0–5.2.4, 6.0.0–6.2.3, 7.0.0–7.5.10, and 8.0.0–8.20.0. The vulnerability stems from insufficient bounds checking on fragmented WebSocket frames. When a peer transmits a high volume of small frame fragments, the server allocates structural wrapper objects (headers, metadata, state containers) for each fragment independent of the actual payload size. This circumvents the library's message-size limit check, which typically validates only the final assembled message. An attacker can trigger rapid out-of-memory (OOM) conditions with modest bandwidth consumption. The issue has been patched in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.

Business impact

Applications relying on ws for WebSocket communication—including real-time chat, collaboration platforms, financial feeds, and IoT command channels—face service unavailability from a single unauthenticated attacker. The low barrier to exploitation (no credentials, modest traffic footprint) and high reliability of the attack make this a practical threat for public-facing WebSocket endpoints. Incident response costs, reputation damage, and lost revenue from extended downtime can be significant, especially if the vulnerable service is mission-critical or customer-facing.

Affected systems

Any Node.js application using ws versions 1.1.0 through 8.20.0 (with the exception of patched releases 5.2.5, 6.2.4, 7.5.11, and 8.21.0 or later) is at risk. Applications importing ws directly, or indirectly through frameworks and packages that bundle it, should be inventoried. Long-term support (LTS) Node.js distributions may still carry vulnerable versions in their package trees. Check your npm lockfile or package-lock.json to confirm the exact version in use.

Exploitability

Exploitability is high. The attack requires only network access to the WebSocket endpoint and no authentication or user interaction. An attacker can craft a simple script to flood the server with fragmented frames, reliably forcing memory exhaustion within seconds to minutes depending on available RAM. Public-facing WebSocket services are directly exposed; internal services are at risk if the attacker has network visibility to the service port. The attack leaves minimal forensic artifacts and can be launched from a single machine or distributed across multiple sources.

Remediation

Upgrade ws to version 5.2.5, 6.2.4, 7.5.11, or 8.21.0 or later, depending on your current version branch. If your application pins a specific major version, upgrade to the next patched minor release in that series. After patching, restart affected Node.js processes. No configuration changes or code modifications are required. For applications unable to patch immediately, consider rate-limiting or network-level filtering of WebSocket connections to reduce exposure.

Patch guidance

Identify your current ws version by running 'npm list ws' in your project directory or checking package.json and package-lock.json. If you are on version 1.x–5.x, upgrade to 5.2.5 or later. If on 6.x, upgrade to 6.2.4 or later. If on 7.x, upgrade to 7.5.11 or later. If on 8.x, upgrade to 8.21.0 or later. Run 'npm update ws' or manually edit package.json and run 'npm install'. Test the upgrade in a staging environment, especially if ws is transitive dependency, to ensure compatibility with other packages. Verify against the official ws GitHub releases and npm package page to confirm the patch version number matches your expectations.

Detection guidance

Monitor Node.js process resource usage (memory) in real time. Alert on rapid memory growth followed by process crashes or OOM killer invocations. Enable WebSocket frame logging (if your application or reverse proxy supports it) to detect unusually high fragmentation rates or frames from a single source. Look for spikes in frame count relative to payload size. Network-level inspection of WebSocket traffic may reveal repetitive, small-payload frames as a precursor to DoS. Correlate process crashes with incoming WebSocket activity using application logs and system metrics.

Why prioritize this

This vulnerability merits immediate patching because of its high CVSS score (7.5), ease of exploitation, and broad applicability across Node.js deployments. The low attack complexity and lack of authentication requirements mean that even small, opportunistic actors can weaponize it. Any publicly accessible Node.js WebSocket service is an immediate target; even internal services are at risk in segmented networks. The patch is straightforward and low-risk, making delay unjustifiable.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible, unauthenticated, low-complexity attack vector with a guaranteed impact on availability (process termination). There is no confidentiality or integrity impact, but the denial of service is complete and reliable. The score does not account for widespread deployment of ws or real-world attack prevalence, but the ease of exploitation and direct denial-of-service effect justify the HIGH severity rating.

Frequently asked questions