CVE-2026-54466

Impact

The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer. Since JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly.

Patches

The issue has been patched in version 0.7.5 by rejecting the message if the length header exceeds the configured maximum message length. All users should upgrade to this version.

Workarounds

No known workarounds exist.

Acknowledgements

This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.

.

Security Fix(es):

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer in lib/websocket/driver/draft75.js; because JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly. This issue is fixed in version 0.7.5.(CVE-2026-54466)

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer in lib/websocket/driver/draft75.js; because JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly. This issue is fixed in version 0.7.5.

TuxCare rebuilt websocket-driver to address 2 CVEs. Fixed in 0.6.5-tuxcare.1.

TuxCare rebuilt websocket-driver to address 2 CVEs. Fixed in 0.7.4-tuxcare.1.

These are all security issues fixed in the agama-web-ui-24+0.a836cced5-52.1 package on the GA media of openSUSE Tumbleweed.

This update for agama-web-ui fixes the following issues:

• CVE-2025-7783: form-data: unsafe Math.random() function is used to select a boundary value for multipart form-encoded data (bsc#1246822).
• CVE-2026-12143: form-data: CRLF injection via unescaped multipart field names and filenames (bsc#1272310).
• CVE-2026-13149: brace-expansion: expand() function exhibits exponential-time complexity when processing non-expanding {} brace groups (bsc#1269927).
• CVE-2026-13311: shell-quote: quadratic complexity in parse() function when processing specially crafted strings (bsc#1269359).
• CVE-2026-13676: fast-uri: host-based policy bypass due to failure to canonicalize Unicode/IDN hostnames for HTTP-family URLs (bsc#1269595).
• CVE-2026-27601: underscore: DoS via stack overflow due to missing depth limits in _.flatten and _.isEqual functions (bsc#1259169).
• CVE-2026-40181: react-router: open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs (bsc#1272311).
• CVE-2026-49356: @babel/core: arbitrary file read via sourceMappingURL comment (bsc#1272317).
• CVE-2026-53550: js-yaml: quadratic complexity in merge-key processing when processing a crafted YAML document (bsc#1268851).
• CVE-2026-53632: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows (bsc#1272319).
• CVE-2026-54466: websocket-driver: message corruption via abuse of protocol length headers (bsc#1272312).
• CVE-2026-54490: websocket-driver: resource limit bypass via message compression (bsc#1272313).
• CVE-2026-55602: http-proxy-middleware: Host-header-driven backend routing bypass via router host+path substring matching (bsc#1272318).

Root has patched CVE-2026-54466 in the websocket-driver package for Root:npm. Multiple fixed versions available.