CVE-2026-62389 | ws before 8.21.1 contains a memory exhaustion vulnerability … | CVSS 7.5 HIGH

Description

ws before 8.21.1 contains a memory exhaustion vulnerability in lib/receiver.js where the fragment guard only triggers when fragment count reaches maxFragments, allowing attackers to exhaust memory by sending incomplete fragmented WebSocket messages. Attackers can send a text frame with FIN=0 followed by continuation frames without completing the sequence, causing each fragment to be stored as a separate Buffer object with significant overhead, enabling denial of service through heap exhaustion.

Metadata

CVE ID: CVE-2026-62389
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-13 22:40 UTC
Published: 2026-07-15 17:04 UTC
Last updated: 2026-07-15 17:55 UTC
Primary CWE: CWE-770
Allocation of Resources Without Limits or Throttling
Vendor / Product: websockets / ws
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
websockets	ws	—	0 < 8.21.1

Weakness (CWE)

CWE	Source	Description
CWE-770	cna	Allocation of Resources Without Limits or Throttling

CVSS scores (2)

Score	Severity	Version	Source	Vector
8.7	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (4)

Researcher Disclosure https://github.com/websockets/ws/issues/2331
Release Notes https://github.com/websockets/ws/releases/tag/8.21.1
Patch Commit https://github.com/websockets/ws/commit/f197ac65140920bdcecdab74bfc69c2d7858e55d
https://www.vulncheck.com/advisories/ws-default-maxfragments-allows-memory-exhaustion-dos