CVE catalog

CVE-2026-45736

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the

[CVE catalog]

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: Apr 11, 2026, 12:49:50 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.74% · Oct 25, 2026

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	node-ws	sid	`8.21.3+~cs14.19.1-1`	fixed
Debian	node-ws	forky	`8.21.3+~cs14.19.1-1`	fixed
Debian	node-ws	trixie	`8.18.1+~cs14.18.2-1`	vulnerable
Debian	node-ws	bookworm	`8.11.0+~cs13.7.3-1`	vulnerable
Cpe	node-ws	Not reported	Not reported	vulnerable
Cpe	ws	Not reported	`8.20.1`	fixed
Cpe	ws	Not reported	`8.20.1`	fixed
Opensuse	zcode	tumbleweed	`3.14.3-1.1`	fixed
Opensuse	kimi-code	leap 16.0	`0.42.0-bp160.1.1`	fixed
Opensuse	kimi-code	tumbleweed	`0.41.0-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	node-ws	source	sid	`8.20.1+~cs14.19.1-1`	not yet assigned	Not reported	[1136804]
Debian	node-ws	source	forky	`8.20.1+~cs14.19.1-1`	not yet assigned	Not reported	[1136804]
Debian	node-ws	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1136804]
Debian	node-ws	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1136804]
Cpe	ws	cpe	Not reported	`8.20.1`	Not reported	Not reported	Not reported
Cpe	ws	cpe	Not reported	`8.20.1`	Not reported	NVD-CVE-2026-45736	Not reported
Opensuse	zcode	rpm	tumbleweed	`3.14.3-1.1`	Not reported	OPENSUSE-SU-2026:11952-1	Not reported
Opensuse	kimi-code	rpm	leap 16.0	`0.42.0-bp160.1.1`	Not reported	OPENSUSE-SU-2026:21849-1	Not reported
Opensuse	kimi-code	rpm	tumbleweed	`0.41.0-1.1`	Not reported	OPENSUSE-SU-2026:11705-1	Not reported

[Debian bug #1136804]

Notes

[trixie] node-ws: Minor issue [bookworm] node-ws: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[node-ws]Affected
Details (2)
- 8.11.0+~cs13.7.3-1 · all · bookworm
  Affected
  nvd · node-ws · debian · bookworm; nvd · node-ws · debian · 12
- 8.11.0+~cs13.7.3-1 · all · bookworm
  Affected
  nvd · node-ws · debian · bookworm; nvd · node-ws · debian · 12

[Debian 13 (Trixie)]

[node-ws]Affected
Details (2)
- 8.18.1+~cs14.18.2-1 · all · trixie
  Affected
  nvd · node-ws · debian · 13
- 8.18.1+~cs14.18.2-1 · all · trixie
  Affected
  nvd · node-ws · debian · 13

[openSUSE Tumbleweed]

[kimi-code]Affected
Source package: [kimi-code]
Details (1)
- 0.36.1-1.1 · x86_64 · tumbleweed
  Affected · Fixed: 0.41.0-1.1
  nvd · kimi-code · opensuse · tumbleweed

Observed: Oct 23, 2026, 10:34:22 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]