Medium · published May 15, 2026
ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.
| Product | Versions | Fixed in |
|---|---|---|
| ws_project/ws | ≥ 8.0.0, < 8.20.1 | 8.20.1 |