VDB
CVE-2026-54490
CVE-2026-54490
PUBLISHED
CVSS 6.3 MEDIUM
Reported by GitHub_M · Published July 17, 2026
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.
Risk Scores
CVSS 4.0
6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| faye | websocket-driver-node | < 0.7.5 |
| chainguard | gitlab-rails-ce-fips-18.1 | 0, 0, 0 |
| chainguard | gitlab-rails-ce-19.0 | 0, 0, 0 |
| chainguard | gitlab-rails-ce-19.1 | 0, 0, 0 |
| npm | websocket-driver | 0 |
| chainguard | arangodb-3.12 | 0, 0, 0 |
| faye | websocket-driver-node | < 0.7.5, < 0.7.5, < 0.7.5 |
| chainguard | gitlab-rails-ce-fips-19.1 | 0, 0, 0 |
| chainguard | gitlab-rails-ce-fips-19.0 | 0, 0, 0 |
| chainguard | arangodb-3.11 | 0, 0, 0 |
| chainguard | gitlab-rails-ce-18.1 | 0, 0, 0 |
Timeline
- Jul 15, 2026 CVE Published
- Jul 18, 2026 EPSS Score
- Jul 18, 2026 Security Advisory
- Jul 23, 2026 CVE Updated
- Aug 7, 2026 EPSS Score
References
- https://github.com/faye/websocket-driver-node/security/advisories/GHSA-mp7j-qc5w-4988 x_refsource_CONFIRM
- https://github.com/faye/websocket-driver-node/commit/c55679a5b18251dd0a55d18a0cc6a4fd8822b92f x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-54490 advisory
- https://github.com/advisories/GHSA-mp7j-qc5w-4988 advisory
- https://github.com/faye/websocket-driver-node/releases/tag/0.7.5 url