I think there may be a problem in package-lock.json around line 17615.
Critical vulnerability in the draft75 WebSocket handler allows unbounded integer growth via malformed frames with high-bit-set bytes (≥0x80). This causes JavaScript 64-bit float precision loss, corrupting payload length parsing. Impact includes denial of service, memory exhaustion, and protocol state corruption. Risk is Critical due to remote exploitability by any connected client.
Something like this might fix it:
--- a/package.json
+++ b/package.json
@@ -deps_section @@
"dependencies": {
- "websocket-driver": "0.7.4",
+ "websocket-driver": "^0.7.5",
}
}
# Reinstall dependencies to apply fix and update package-lock.json:
$ npm installFor reference: rule CVE-2026-54466. Rated critical.
I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
I think there may be a problem in
package-lock.jsonaround line 17615.Critical vulnerability in the draft75 WebSocket handler allows unbounded integer growth via malformed frames with high-bit-set bytes (≥0x80). This causes JavaScript 64-bit float precision loss, corrupting payload length parsing. Impact includes denial of service, memory exhaustion, and protocol state corruption. Risk is Critical due to remote exploitability by any connected client.
Something like this might fix it:
For reference: rule
CVE-2026-54466. Rated critical.I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.