Every CVE Search/ Get API key

CVE-2026-54490

websocket-driver: Resource limit bypass via message compression

6.3 MediumFix available

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.45%Unchanged since Jul 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.3

websocket-driver: Resource limit bypass via message compression

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.

Record
CVE-2026-54490
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2026-45336 6.3

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.

Record
EUVD-2026-45336
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-mp7j-qc5w-4988 6.3

websocket-driver: Resource limit bypass via message compression

Impact

If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage.

Patches

The issue has been patched in version 0.7.5, by checking the length of messages after they are processed by incoming extensions. All users should upgrade to this version.

Workarounds

No known workarounds exist.

Acknowledgements

This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.

Record
GHSA-mp7j-qc5w-4988
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Weakness
CWE-770
Updated
2026-11-02
NVD 6.3

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.

Record
CVE-2026-54490
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-770
Updated
2026-11-02
OSV 6.3

websocket-driver: Resource limit bypass via message compression

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.

Record
CVE-2026-54490
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Weakness
CWE-770
Updated
2026-11-02
OSVDEBIAN-CVE-2026-54490 6.3

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.

Record
DEBIAN-CVE-2026-54490
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-mp7j-qc5w-4988 6.3

websocket-driver: Resource limit bypass via message compression

Impact

If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage.

Patches

The issue has been patched in version 0.7.5, by checking the length of messages after they are processed by incoming extensions. All users should upgrade to this version.

Workarounds

No known workarounds exist.

Acknowledgements

This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.

Record
GHSA-mp7j-qc5w-4988
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Weakness
CWE-770
Updated
2026-11-02
OSVUBUNTU-CVE-2026-54490 6.3

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.

Record
UBUNTU-CVE-2026-54490
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Updated
2026-11-02
OSVCLSA-2026-1784856035 No score

TuxCare security update for websocket-driver (2 CVEs)

TuxCare rebuilt websocket-driver to address 2 CVEs. Fixed in 0.6.5-tuxcare.1.

Record
CLSA-2026-1784856035
Updated
2026-11-02
OSVCLSA-2026-1789479340 No score

TuxCare security update for websocket-driver (2 CVEs)

TuxCare rebuilt websocket-driver to address 2 CVEs. Fixed in 0.7.4-tuxcare.1.

Record
CLSA-2026-1789479340
Updated
2026-11-02
OSVopenSUSE-SU-2026:21448-1 No score

Security update for agama-web-ui

This update for agama-web-ui fixes the following issues:

  • CVE-2025-7783: form-data: unsafe Math.random() function is used to select a boundary value for multipart form-encoded data (bsc#1246822).
  • CVE-2026-12143: form-data: CRLF injection via unescaped multipart field names and filenames (bsc#1272310).
  • CVE-2026-13149: brace-expansion: expand() function exhibits exponential-time complexity when processing non-expanding {} brace groups (bsc#1269927).
  • CVE-2026-13311: shell-quote: quadratic complexity in parse() function when processing specially crafted strings (bsc#1269359).
  • CVE-2026-13676: fast-uri: host-based policy bypass due to failure to canonicalize Unicode/IDN hostnames for HTTP-family URLs (bsc#1269595).
  • CVE-2026-27601: underscore: DoS via stack overflow due to missing depth limits in _.flatten and _.isEqual functions (bsc#1259169).
  • CVE-2026-40181: react-router: open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs (bsc#1272311).
  • CVE-2026-49356: @babel/core: arbitrary file read via sourceMappingURL comment (bsc#1272317).
  • CVE-2026-53550: js-yaml: quadratic complexity in merge-key processing when processing a crafted YAML document (bsc#1268851).
  • CVE-2026-53632: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows (bsc#1272319).
  • CVE-2026-54466: websocket-driver: message corruption via abuse of protocol length headers (bsc#1272312).
  • CVE-2026-54490: websocket-driver: resource limit bypass via message compression (bsc#1272313).
  • CVE-2026-55602: http-proxy-middleware: Host-header-driven backend routing bypass via router host+path substring matching (bsc#1272318).
Record
openSUSE-SU-2026:21448-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
websocket-driver
npm
 before 0.7.5
0.7.5
websocket-driver
TuxCare:npm
 0.6.5-tuxcare.0 up to 0.6.5-tuxcare.1, plus listed versions
0.6.5
0.6.5-tuxcare.1
websocket-driver
TuxCare:npm
 0.7.4-tuxcare.0 up to 0.7.4-tuxcare.1, plus listed versions
0.7.4
0.7.4-tuxcare.1
node-websocket-driver
Debian:12
 All versions, plus listed versions
0.7.4+~cs0.6.14-10.7.4+~cs0.6.7-20.7.5+~cs0.6.14-1
 None known
node-websocket-driver
Debian:13
 All versions, plus listed versions
0.7.4+~cs0.6.14-10.7.4+~cs0.6.7-20.7.5+~cs0.6.14-1
 None known
node-websocket-driver
Debian:14
 before 0.7.5+~cs0.6.14-1, plus listed versions
0.7.4+~cs0.6.14-10.7.4+~cs0.6.7-2
0.7.5+~cs0.6.14-1
node-websocket-driver
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.3.5-1
 None known
node-websocket-driver
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.3.5-1
 None known
node-websocket-driver
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.3.5-1
 None known
node-websocket-driver
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.7.4+~cs0.6.7-2
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
node-websocket-driver
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.7.4+~cs0.6.7-2
 None known
node-websocket-driver
Ubuntu:26.10
 All versions, plus listed versions
0.7.4+~cs0.6.14-10.7.5+~cs0.6.14-1
 None known
node-websocket-driver
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.7.4+~cs0.6.7-20.7.4+~cs0.6.14-1
 None known
agama-web-ui
openSUSE:Leap 16.0
 before 17+673.b97ba64d6-160000.12.1
17+673.b97ba64d6-160000.12.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-54490 is a medium vulnerability (CVSS 6.3) in Faye Websocket-driver-node, published July 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 38th percentile. Fixed in websocket-driver 0.7.5.

References

Show 31 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open