Source: node-ws Version: 8.21.0+~cs14.19.1-1 Severity: important Tags: security upstream Forwarded: https://github.com/websockets/ws/issues/2331 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for node-ws. CVE-2026-62389[0]: | ws before 8.21.1 contains a memory exhaustion vulnerability in | lib/receiver.js where the fragment guard only triggers when fragment | count reaches maxFragments, allowing attackers to exhaust memory by | sending incomplete fragmented WebSocket messages. Attackers can send | a text frame with FIN=0 followed by continuation frames without | completing the sequence, causing each fragment to be stored as a | separate Buffer object with significant overhead, enabling denial of | service through heap exhaustion. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-62389 https://www.cve.org/CVERecord?id=CVE-2026-62389 [1] https://github.com/websockets/ws/issues/2331 [2] https://github.com/websockets/ws/commit/f197ac65140920bdcecdab74bfc69c2d7858e55d Please adjust the affected versions in the BTS as needed. Regards, Salvatore
