REDHAT-BUG-2477914: High severity npm/ws vulnerability

Q: What is the severity of REDHAT-BUG-2477914?

The severity of REDHAT-BUG-2477914 is high with a score of 7.

Q: What is the description of the vulnerability REDHAT-BUG-2477914?

REDHAT-BUG-2477914 is a vulnerability in the websocket.close() implementation of the ws library prior to version 8.20.1, which allows for uninitialized memory disclosure.

Q: How do I fix REDHAT-BUG-2477914?

To fix REDHAT-BUG-2477914, update the ws library to version 8.20.1 or later.

Q: What software is affected by REDHAT-BUG-2477914?

The software affected by REDHAT-BUG-2477914 is the npm/ws library.

Q: When was the vulnerability REDHAT-BUG-2477914 published?

The vulnerability REDHAT-BUG-2477914 was published on May 15, 2026.

Published May 15, 2026

Updated

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

Affected Software

1 affected component

npm/ws<8.20.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ws to a version that resolves this vulnerability.
Fixed in 8.20.1

Event History

May 15, 2026

Data Sourced

via Red Hat·04:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2477914?

The severity of REDHAT-BUG-2477914 is high with a score of 7.

What is the description of the vulnerability REDHAT-BUG-2477914?

REDHAT-BUG-2477914 is a vulnerability in the websocket.close() implementation of the ws library prior to version 8.20.1, which allows for uninitialized memory disclosure.

How do I fix REDHAT-BUG-2477914?