CVE-2026-54466

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer in lib/websocket/driver/draft75.js; because JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly. This issue is fixed in version 0.7.5.

• CWE-130

• https://github.com/faye/websocket-driver-node/commit/5b197ca874dab58e96cacad8a3c256797d804680Patch
• https://github.com/faye/websocket-driver-node/security/advisories/GHSA-xv26-6w52-cph6Vendor Advisory

Published

Jul 17, 2026

Last Modified

Aug 6, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5445An out-of-bounds read vulnerability exists in the `DecodeLoo…9.1
• CVE-2026-54458WWBN AVideo is an open source video platform. Versions prior…9.6
• CVE-2026-5446In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS …7.1
• CVE-2026-54463websocket-driver is a WebSocket protocol handler with plugga…7.5
• CVE-2026-54464### Impact If this library is used in tandem with the `perm…6.3
• CVE-2026-54465websocket-driver is a WebSocket protocol handler with plugga…7.5
• CVE-2026-54468Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, …6.5
• CVE-2026-54469Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, …8.8
• CVE-2026-5447Heap buffer overflow in CertFromX509 via AuthorityKeyIdentif…7.5
• CVE-2026-54470Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior c…5.3
• CVE-2026-54475Missing Authorization vulnerability in Apache ActiveMQ Broke…7.5
• CVE-2026-54477The admin panel lacks standard security headers, enabling cl…5.4