Security vulnerabilities and automated fixes for websocket issues
6 posts found
CVE-2026-54466 is a critical vulnerability in the `websocket-driver` npm package (versions prior to 0.7.5) that exposes applications to exploitation through malformed WebSocket protocol input. The fix pins the dependency to `0.7.5` via a pnpm override, closing the attack surface in both `faye-websocket` and any other consumers in the dependency tree. Because WebSocket connections are a common real-time communication channel, leaving this unpatched puts any application that handles untrusted WebS
A critical vulnerability (CVE-2026-54466) was discovered in websocket-driver version 0.7.4, a widely-used WebSocket protocol handler in the Node.js ecosystem. This fix upgrades the dependency to version 0.7.5 using npm overrides in the docs-site package, eliminating the vulnerability from the dependency tree without requiring changes to direct dependencies.
Python-SocketIO versions prior to 5.16.2 contained a critical vulnerability where binary attachments could accumulate without bounds, allowing attackers to exhaust server memory and trigger a denial of service. This vulnerability has been patched through a dependency upgrade that implements proper resource limits on attachment handling.
A high-severity vulnerability (CVE-2026-48802) in python-engineio 4.12.2 allowed attackers to exhaust system resources through unbound thread allocation, leading to denial of service. The fix upgrades the dependency to version 4.13.2, which implements thread pool limits to prevent resource exhaustion attacks against real-time WebSocket applications.
A critical vulnerability (CVE-2026-54466) in websocket-driver versions prior to 0.7.5 allows attackers to corrupt WebSocket messages by manipulating protocol length headers. This can lead to data integrity issues, denial of service, or potentially arbitrary code execution in affected Node.js applications. The fix involves upgrading the websocket-driver dependency to version 0.7.5.
A medium-severity vulnerability was discovered in a JavaScript streaming application where insecure WebSocket (ws://) connections were being used instead of secure WebSocket (wss://) connections. This security gap could expose sensitive data to man-in-the-middle attacks, allowing attackers to intercept and manipulate real-time communication between clients and servers.