CVE-2026-62389: ws < 8.21.1 Default maxFragments Allows Memory Exhaustion DoS
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-48779.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wsto a version that resolves this vulnerability.Fixed in 8.21.1 - Configuration
If upgrading to ws < 8.21.1 is not immediately possible, reduce the WebSocket receiver fragment allowance by configuring maxFragments to a lower value so the fragment guard triggers earlier (in ws before 8.21.1 it only triggers when the fragment count reaches maxFragments).
ws maxFragments = <= specified limit
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62389?
The severity of CVE-2026-62389 is high, with a score of 7.5.
How do I fix CVE-2026-62389?
To fix CVE-2026-62389, upgrade to ws version 8.21.1 or later.
What type of attack is associated with CVE-2026-62389?
CVE-2026-62389 is associated with memory exhaustion denial-of-service (DoS) attacks.
Which software versions are affected by CVE-2026-62389?
CVE-2026-62389 affects all versions of ws prior to 8.21.1.
What is the impact of CVE-2026-62389 on affected systems?
The impact of CVE-2026-62389 on affected systems is potential memory exhaustion, leading to service disruptions.