chore(deps): update dependency ws to v8.20.1 [security] (v2)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ws	8.18.1 → 8.20.1

---

ws: Uninitialized memory disclosure

CVE-2026-45736 / GHSA-58qx-3vcg-4xpx

More information

Details

Impact

The websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.

Proof of concept

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer(
  { port: 0, skipUTF8Validation: true },
  function () {
    const { port } = wss.address();
    const ws = new WebSocket(`ws://localhost:${port}`, {
      skipUTF8Validation: true
    });

    ws.on('close', function (code, reason) {
      deepStrictEqual(reason, Buffer.alloc(80));
    });
  }
);

wss.on('connection', function (ws) {
  ws.close(1000, new Float32Array(20));
});

Patches

The vulnerability was fixed in ws@8.20.1 (websockets/ws@c0327ec).

Credits

Credit for the private and responsible disclosure of this issue goes to Nikita Skovoroda.

Remarks

Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.

Resources

• GHSA-58qx-3vcg-4xpx
• https://www.cve.org/CVERecord?id=CVE-2026-45736

Severity

• CVSS Score: 4.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx
• https://nvd.nist.gov/vuln/detail/CVE-2026-45736
• https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086
• https://github.com/advisories/GHSA-58qx-3vcg-4xpx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

websockets/ws (ws)

v8.20.1

Compare Source

Bug fixes

• Fixed an uninitialized memory disclosure issue in websocket.close()
  (c0327ec).

Providing a TypedArray (e.g. Float32Array) as the reason argument for
websocket.close(), rather than the supported string or Buffer types, caused
uninitialized memory to be disclosed to the remote peer.

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer(
  { port: 0, skipUTF8Validation: true },
  function () {
    const { port } = wss.address();
    const ws = new WebSocket(`ws://localhost:${port}`, {
      skipUTF8Validation: true
    });

    ws.on('close', function (code, reason) {
      deepStrictEqual(reason, Buffer.alloc(80));
    });
  }
);

wss.on('connection', function (ws) {
  ws.close(1000, new Float32Array(20));
});

The issue was privately reported by Nikita Skovoroda.

v8.20.0

Compare Source

Features

• Added exports for the PerMessageDeflate class and utilities for the
  Sec-WebSocket-Extensions and Sec-WebSocket-Protocol headers (d3503c1).

v8.19.0

Compare Source

Features

• Added the closeTimeout option (#​2308).

Bug fixes

• Handled a forthcoming breaking change in Node.js core (1998485).

v8.18.3

Compare Source

Bug fixes

• Fixed a spec violation where the Sec-WebSocket-Version header was not added
  to the HTTP response if the client requested version was either invalid or
  unacceptable (#​2291).

v8.18.2

Compare Source

Bug fixes

• Fixed an issue that, during message decompression when the maximum size was
  exceeded, led to the emission of an inaccurate error and closure of the
  connection with an improper close code (#​2285).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9f9f95a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[netlify]

❌ Deploy Preview for modernjs-v2 failed. Why did it fail? →

Name	Link
🔨 Latest commit	9f9f95a
🔍 Latest deploy log	https://app.netlify.com/projects/modernjs-v2/deploys/6a0d5de03aad1f0008084897