CVE-2026-48779: ws: Memory exhaustion DoS from tiny fragments and data chunks

Synopsis

Memory exhaustion denial-of-service vulnerability in the ws WebSocket library for Node.js. An attacker reachable over the network, with no authentication required, can send a high volume of tiny WebSocket fragments and data chunks that force the receiving process to allocate structural wrappers far exceeding the documented message-size limit, eventually crashing the process due to out-of-memory conditions. Patched-image rebuilds at ws versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the target ws server or client over the network and establish a WebSocket connection to it.

• AuthenticationNot required

  No credentials or prior authentication are needed; any peer that can open a WebSocket connection can trigger the condition.

• Victim interactionNot required

  No user action is required; the server processes incoming WebSocket frames passively and accumulates memory without any victim clicking or approving anything.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker simply sends a sustained stream of minimal fragments and the memory growth follows deterministically.

Blast Radius

• The targeted Node.js process exhausts available memory and is terminated by the operating system OOM killer, taking down all in-process request handling.
• Any in-flight WebSocket sessions handled by the same process are dropped without graceful shutdown, severing real-time connections for all connected clients.
• If the ws server runs inside a single-replica deployment with no auto-restart, the service becomes fully unavailable until the process is manually restarted or a watchdog revives it.
• No confidential data is read and no persistent data is modified; impact is limited to availability.