CVE-2026-45736: ws: Uninitialized memory disclosure

May 18, 2026

The websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.

References

github.com/advisories/GHSA-58qx-3vcg-4xpx
github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086
github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx
nvd.nist.gov/vuln/detail/CVE-2026-45736

Code Behaviors & Features

Detect and mitigate CVE-2026-45736 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →