faye websocket-driver up to 0.7.4 Permessage-Deflate Extension hybi.js accept out-of-bounds write

Summaryinfo

A vulnerability classified as problematic has been found in faye websocket-driver up to 0.7.4. This vulnerability affects the function Accept of the file lib/websocket/driver/hybi.js of the component Permessage-Deflate Extension. This manipulation causes out-of-bounds write. This vulnerability is tracked as CVE-2026-54490. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in faye websocket-driver up to 0.7.4. It has been declared as problematic. Affected by this vulnerability is the function accept of the file lib/websocket/driver/hybi.js of the component Permessage-Deflate Extension. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. The summary by CVE is:

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-54490 since 06/15/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.7.5 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-45336). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Hardware Driver Software

Vendor

• faye

Name

• websocket-driver

Version

• 0.7.0
• 0.7.1
• 0.7.2
• 0.7.3
• 0.7.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion