CVE-2026-45736

A flaw was found in ws, an open source WebSocket client and server for Node.js. The websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memory.

This Important vulnerability in the ws WebSocket library for Node.js could lead to sensitive information disclosure. The flaw occurs when a TypedArray is specifically provided as the reason argument to the websocket.close() function, potentially exposing uninitialized memory. Red Hat products utilizing this library may be affected if their implementations allow for such a crafted close() call.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.