{"id":"CVE-2026-54490","aliases":["CLSA-2026-1784856035","CLSA-2026-1789479340","DEBIAN-CVE-2026-54490","EUVD-2026-45336","GHSA-mp7j-qc5w-4988","UBUNTU-CVE-2026-54490","openSUSE-SU-2026:21448-1"],"status":"published","title":"websocket-driver: Resource limit bypass via message compression","description":"websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00445,"percentile":0.39142,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-07-15T22:08:17Z","modified":"2026-10-30T19:46:02Z","fixes":[{"ecosystem":"npm","package":"websocket-driver","fixed_in":["0.7.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"node-websocket-driver","fixed_in":["0.7.5+~cs0.6.14-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"websocket-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.5"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"websocket-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.5-tuxcare.0"},{"fixed":"0.6.5-tuxcare.1"}]}],"versions":["0.6.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"websocket-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.4-tuxcare.0"},{"fixed":"0.7.4-tuxcare.1"}]}],"versions":["0.7.4"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-websocket-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.4+~cs0.6.14-1","0.7.4+~cs0.6.7-2","0.7.5+~cs0.6.14-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-websocket-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.4+~cs0.6.14-1","0.7.4+~cs0.6.7-2","0.7.5+~cs0.6.14-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-websocket-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.5+~cs0.6.14-1"}]}],"versions":["0.7.4+~cs0.6.14-1","0.7.4+~cs0.6.7-2"]},{"source":"osv","ecosystem":"npm","package":"websocket-driver","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.5"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-websocket-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.5-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-websocket-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.5-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-websocket-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.5-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-websocket-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.4+~cs0.6.7-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-websocket-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.4+~cs0.6.7-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-websocket-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.4+~cs0.6.14-1","0.7.5+~cs0.6.14-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-websocket-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.4+~cs0.6.7-2","0.7.4+~cs0.6.14-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"agama-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17+673.b97ba64d6-160000.12.1"}]}],"bundled":13}],"products":[{"vendor":"faye","product":"websocket-driver-node"}],"references":[{"url":"https://github.com/faye/websocket-driver-node/security/advisories/GHSA-mp7j-qc5w-4988","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/faye/websocket-driver-node/commit/c55679a5b18251dd0a55d18a0cc6a4fd8822b92f","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/faye/websocket-driver-node/releases/tag/0.7.5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mp7j-qc5w-4988"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54490.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54490","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54490","tags":["advisory"]},{"url":"https://github.com/faye/websocket-driver-node","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-54490","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54490","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1246822","tags":["report"]},{"url":"https://bugzilla.suse.com/1259169","tags":["report"]},{"url":"https://bugzilla.suse.com/1268851","tags":["report"]},{"url":"https://bugzilla.suse.com/1269359","tags":["report"]},{"url":"https://bugzilla.suse.com/1269514","tags":["report"]},{"url":"https://bugzilla.suse.com/1269595","tags":["report"]},{"url":"https://bugzilla.suse.com/1269927","tags":["report"]},{"url":"https://bugzilla.suse.com/1272310","tags":["report"]},{"url":"https://bugzilla.suse.com/1272311","tags":["report"]},{"url":"https://bugzilla.suse.com/1272312","tags":["report"]},{"url":"https://bugzilla.suse.com/1272313","tags":["report"]},{"url":"https://bugzilla.suse.com/1272317","tags":["report"]},{"url":"https://bugzilla.suse.com/1272318","tags":["report"]},{"url":"https://bugzilla.suse.com/1272319","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55602","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-54490","title":"websocket-driver: Resource limit bypass via message compression","description":"websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.","status":"published","published":"2026-07-17T20:54:22.417Z","modified":"2026-07-21T02:23:58.273Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:38:09.774038Z"}],"euvd":[{"id":"EUVD-2026-45336","description":"websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.","status":"published","published":"2026-07-17T20:54:22Z","modified":"2026-07-21T02:23:58Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","level":"medium"}],"updated_at":"2026-11-02T18:19:47.959089Z"}],"ghsa":[{"id":"GHSA-mp7j-qc5w-4988","title":"websocket-driver: Resource limit bypass via message compression","description":"### Impact\n\nIf this library is used in tandem with the `permessage-deflate` extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage.\n\n### Patches\n\nThe issue has been patched in version 0.7.5, by checking the length of messages after they are processed by incoming extensions. All users should upgrade to this version.\n\n### Workarounds\n\nNo known workarounds exist.\n\n### Acknowledgements\n\nThis issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.","status":"published","published":"2026-07-15T22:08:17Z","modified":"2026-07-15T22:08:18Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:40:44.915484Z"}],"nvd":[{"id":"CVE-2026-54490","description":"websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.","status":"published","published":"2026-07-17T21:17:08.78Z","modified":"2026-10-24T20:10:00.137Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:30.631352Z"}],"osv":[{"id":"CVE-2026-54490","title":"websocket-driver: Resource limit bypass via message compression","description":"websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.","status":"published","published":"2026-07-17T20:54:22.417Z","modified":"2026-10-28T02:30:32.346030809Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"DEBIAN-CVE-2026-54490","description":"websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.","status":"published","published":"2026-07-17T21:17:08.78Z","modified":"2026-10-25T09:47:32.973705175Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"GHSA-mp7j-qc5w-4988","title":"websocket-driver: Resource limit bypass via message compression","description":"### Impact\n\nIf this library is used in tandem with the `permessage-deflate` extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage.\n\n### Patches\n\nThe issue has been patched in version 0.7.5, by checking the length of messages after they are processed by incoming extensions. All users should upgrade to this version.\n\n### Workarounds\n\nNo known workarounds exist.\n\n### Acknowledgements\n\nThis issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.","status":"published","published":"2026-07-15T22:08:17Z","modified":"2026-09-10T03:50:52.769661814Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"UBUNTU-CVE-2026-54490","description":"websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.","status":"published","published":"2026-07-17T21:17:00Z","modified":"2026-10-17T12:59:05.465704788Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"CLSA-2026-1784856035","title":"TuxCare security update for websocket-driver (2 CVEs)","description":"TuxCare rebuilt websocket-driver to address 2 CVEs. Fixed in 0.6.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-30T19:46:02.489500023Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1789479340","title":"TuxCare security update for websocket-driver (2 CVEs)","description":"TuxCare rebuilt websocket-driver to address 2 CVEs. Fixed in 0.7.4-tuxcare.1.","status":"published","published":"2026-09-15T13:35:40Z","modified":"2026-10-30T19:46:01.622623977Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"openSUSE-SU-2026:21448-1","title":"Security update for agama-web-ui","description":"This update for agama-web-ui fixes the following issues:\n\n- CVE-2025-7783: form-data: unsafe `Math.random()` function is used to select a boundary value for multipart\n  form-encoded data (bsc#1246822).\n- CVE-2026-12143: form-data: CRLF injection via unescaped multipart field names and filenames (bsc#1272310).\n- CVE-2026-13149: brace-expansion: `expand()` function exhibits exponential-time complexity when processing\n  non-expanding `{}` brace groups (bsc#1269927).\n- CVE-2026-13311: shell-quote: quadratic complexity in `parse()` function when processing specially crafted strings\n  (bsc#1269359).\n- CVE-2026-13676: fast-uri: host-based policy bypass due to failure to canonicalize Unicode/IDN hostnames for\n  HTTP-family URLs (bsc#1269595).\n- CVE-2026-27601: underscore: DoS via stack overflow due to missing depth limits in `_.flatten` and `_.isEqual`\n  functions (bsc#1259169).\n- CVE-2026-40181: react-router: open redirect to an external domain due to path values starting with `//` being\n  reinterpreted as protocol-relative URLs (bsc#1272311).\n- CVE-2026-49356: @babel/core: arbitrary file read via `sourceMappingURL` comment (bsc#1272317).\n- CVE-2026-53550: js-yaml: quadratic complexity in merge-key processing when processing a crafted YAML document\n  (bsc#1268851).\n- CVE-2026-53632: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows (bsc#1272319).\n- CVE-2026-54466: websocket-driver: message corruption via abuse of protocol length headers (bsc#1272312).\n- CVE-2026-54490: websocket-driver: resource limit bypass via message compression (bsc#1272313).\n- CVE-2026-55602: http-proxy-middleware: Host-header-driven backend routing bypass via `router` host+path substring\n  matching (bsc#1272318).\n","status":"published","published":"2026-07-27T15:55:38Z","modified":"2026-07-29T18:24:28.648555524Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}