CVE-2026-54490: websocket-driver DoS Vulnerability

CVE-2026-54490 Overview

CVE-2026-54490 affects websocket-driver, a Node.js WebSocket protocol handler with pluggable I/O. Versions prior to 0.7.5 fail to enforce the configured maximum message size when the permessage-deflate extension is enabled. The library checks the length header of incoming frames, which reflects the compressed payload size rather than the decompressed size. An attacker can send small compressed frames that expand into much larger payloads after decompression. This results in servers and clients accepting messages beyond the intended size limit, leading to excessive memory and CPU consumption [CWE-770].

Critical Impact
Remote unauthenticated attackers can bypass message size limits using compression, causing resource exhaustion in WebSocket applications.

Affected Products

websocket-driver (Node.js) versions prior to 0.7.5
Applications using websocket-driver with the permessage-deflate extension enabled
Downstream packages depending on vulnerable websocket-driver releases (including Faye-based stacks)

Discovery Timeline

2026-07-17 - CVE-2026-54490 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-54490

Vulnerability Analysis

The vulnerability resides in lib/websocket/driver/hybi.js, which handles the WebSocket hybi framing protocol. When permessage-deflate is negotiated, incoming frames arrive in compressed form. The driver enforces the maxLength limit against the raw frame length field before decompression completes. Compressed WebSocket payloads can decompress to sizes several orders of magnitude larger than the wire size. This mismatch allows an attacker to submit a small compressed frame that expands into a payload exceeding the configured maxLength. Applications relying on the size cap for memory budgeting are silently overrun.

Root Cause

The root cause is an [CWE-770] allocation of resources without limits after decompression. The length check operated on the compressed frame header rather than on the decompressed message payload. As a result, the maxLength guard did not apply to the actual buffer the application received.

Attack Vector

Exploitation requires a network-reachable WebSocket endpoint that accepts permessage-deflate. An unauthenticated peer sends a highly compressible payload (for example, long runs of repeated bytes) framed within the negotiated size limit. After inflation, the driver hands the oversized buffer to the application, which allocates memory proportional to the decompressed size. Repeated messages amplify memory and CPU usage until the process becomes unresponsive.

javascript

// Patch excerpt from lib/websocket/driver/hybi.js
       if (error) return this._fail('extension_error', error.message);

       var payload = message.data;
-      if (message.opcode === this.OPCODES.text) payload = this._encode(payload);
+
+      if (payload.length > this._maxLength)
+        return this._fail('too_large', 'WebSocket frame length too large');
+
+      if (message.opcode === this.OPCODES.text)
+        payload = this._encode(payload);

       if (payload === null)
         return this._fail('encoding_error', 'Could not decode a text frame as UTF-8');
// Source: https://github.com/faye/websocket-driver-node/commit/c55679a5b18251dd0a55d18a0cc6a4fd8822b92f

The patch adds a post-decompression length check. If the inflated payload.length exceeds _maxLength, the connection is failed with too_large before the payload is forwarded.

Detection Methods for CVE-2026-54490

Indicators of Compromise

WebSocket connections negotiating permessage-deflate followed by abnormal spikes in Node.js process memory usage
Repeated inbound frames with high compression ratios (small payload_len header, large decompressed output)
Application logs showing out-of-memory errors or event loop stalls tied to WebSocket handlers

Detection Strategies

Inventory Node.js applications and audit package-lock.json or yarn.lock for websocket-driver versions below 0.7.5
Instrument WebSocket handlers to log decompressed payload sizes and compare against configured maxLength
Enable process-level memory and event-loop lag metrics for services exposing WebSocket endpoints

Monitoring Recommendations

Alert on sustained memory growth in WebSocket-serving processes correlated with active client connections
Track connection-level compression ratios and flag sessions where inflated size exceeds a defined threshold
Forward Node.js runtime logs and WebSocket close codes to a centralized log platform for anomaly review

How to Mitigate CVE-2026-54490

Immediate Actions Required

Upgrade websocket-driver to version 0.7.5 or later across all Node.js applications
Rebuild and redeploy dependent packages (including Faye and any framework bundling websocket-driver) to pick up the fixed transitive dependency
Review application-level maxLength settings and lower them where feasible to reduce blast radius

Patch Information

The fix is available in websocket-driver version 0.7.5. The upstream commit adds a post-decompression length check in lib/websocket/driver/hybi.js that fails the connection with too_large when the inflated payload exceeds _maxLength. See the GitHub Security Advisory GHSA-mp7j-qc5w-4988 and the upstream patch commit for details.

Workarounds

Disable the permessage-deflate extension in server and client configuration until patching is complete
Enforce strict maximum message size at the reverse proxy or load balancer in front of the WebSocket service
Apply per-connection rate limits and memory quotas to constrain resource use from abusive peers

bash

# Update the dependency to the fixed version
npm install websocket-driver@^0.7.5

# Verify no vulnerable versions remain in the dependency tree
npm ls websocket-driver

# Audit for known advisories
npm audit --production