CVE-2026-54466: websocket-driver DoS Vulnerability

CVE-2026-54466 Overview

CVE-2026-54466 affects websocket-driver, a Node.js WebSocket protocol handler with pluggable I/O used by frameworks such as Faye. Versions prior to 0.7.5 mishandle the length header in draft-75/76 WebSocket frames. An unauthenticated remote attacker can stream bytes with the high bit set to force the server to accumulate an ever-growing integer. Because JavaScript numbers use 64-bit floating point representation, the value eventually loses precision and subsequent payload parsing becomes incorrect. This flaw is categorized under [CWE-130] Improper Handling of Length Parameter Inconsistency.

Critical Impact
Attackers can corrupt WebSocket frame parsing over the network without authentication or user interaction, undermining integrity of both the vulnerable service and downstream components.

Affected Products

websocket-driver (Node.js) versions prior to 0.7.5
Applications and frameworks embedding websocket-driver for WebSocket protocol handling
Services accepting legacy draft-75/76 WebSocket handshakes

Discovery Timeline

2026-07-17 - CVE-2026-54466 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-54466

Vulnerability Analysis

The vulnerability resides in lib/websocket/driver/draft75.js, which parses frame length headers from early WebSocket protocol drafts. The length field is encoded as a variable-length sequence of bytes where any byte with the high bit (0x80) set indicates that more length bytes follow. The parser multiplies the running total by 128 and adds the lower seven bits of the next byte on every iteration. No upper bound is enforced on the number of length bytes consumed or on the resulting integer value.

Because JavaScript stores all numbers as IEEE 754 double-precision floats, the accumulated this._length value loses precision once it exceeds Number.MAX_SAFE_INTEGER (2^53 − 1). After precision loss, subsequent arithmetic on the length field no longer matches the true byte count. The server then misaligns payload parsing, breaking the integrity of the WebSocket message stream.

Root Cause

The root cause is a missing bounds check on the decoded length header in the draft-75 parser. The loop that accumulates length bytes trusts client-supplied data without validating against a configured maximum.

Attack Vector

An unauthenticated attacker sends an indefinite sequence of bytes with values 0x80 or higher to a vulnerable WebSocket endpoint. The server keeps extending this._length until precision degrades, at which point framing integrity is lost. The attack requires only network reachability to a listening WebSocket service that accepts draft-75/76 handshakes.

javascript

// Patch from lib/websocket/driver/draft75.js
// Source: https://github.com/faye/websocket-driver-node/commit/5b197ca874dab58e96cacad8a3c256797d804680

        case 1:
          this._length = (octet & 0x7F) + 128 * this._length;
+         if (this._length > this._maxLength) return this.close();

          if (this._closing && this._length === 0) {
            return this.close();

The patch closes the connection as soon as the accumulated length exceeds the configured _maxLength, preventing unbounded growth of the integer.

Detection Methods for CVE-2026-54466

Indicators of Compromise

Inbound WebSocket handshakes negotiating draft-75 or draft-76 protocol versions from untrusted clients.
WebSocket frames containing long runs of bytes with the high bit set (>= 0x80) preceding a payload.
Node.js processes hosting websocket-driver < 0.7.5 reporting protocol errors or unexpected connection resets on WebSocket endpoints.

Detection Strategies

Inventory Node.js dependencies with npm ls websocket-driver and flag any resolved version below 0.7.5.
Inspect reverse-proxy and application access logs for WebSocket upgrade requests using legacy draft protocols.
Deploy network signatures that alert on WebSocket frames with anomalously long length-header byte sequences.

Monitoring Recommendations

Track WebSocket connection duration and byte counts to surface sessions that transmit large volumes without completing frames.
Correlate WebSocket parser exceptions and abrupt socket closures with source IPs to identify probing activity.
Alert on new deployments that pin websocket-driver to versions older than 0.7.5 in build artifacts.

How to Mitigate CVE-2026-54466

Immediate Actions Required

Upgrade websocket-driver to version 0.7.5 or later across all Node.js services and transitive dependencies.
Rebuild and redeploy container images and serverless bundles that vendor the vulnerable module.
Restart long-running Node.js processes after updating to ensure the patched module is loaded.

Patch Information

The fix is committed in faye/websocket-driver-node commit 5b197ca and released in version 0.7.5. It enforces the _maxLength bound during draft-75/76 length parsing and closes the connection when the limit is exceeded. See the GitHub Security Advisory GHSA-xv26-6w52-cph6 for the full advisory.

Workarounds

Disable draft-75 and draft-76 WebSocket protocol support at the application or proxy layer where feasible.
Terminate WebSocket traffic at a reverse proxy that enforces strict frame-size and header-length limits.
Restrict WebSocket endpoints to authenticated clients on trusted networks until the upgrade is applied.

bash

# Upgrade websocket-driver to the patched release
npm install websocket-driver@^0.7.5
npm ls websocket-driver

# Audit for remaining vulnerable transitive versions
npm audit --production