https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 03:06:39 +0000 https://vulnerability.circl.lu/vuln/ghsa-xv26-6w52-cph6 <p><strong>Affected:</strong> npm: websocket-driver</p> <p>### Impact</p> <p>The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values `0x80` or above, a client can make the server parse these bytes into an ever-growing integer. Since JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly.</p> <p>### Patches</p> <p>The issue has been patched in version 0.7.5 by rejecting the message if the length header exceeds the configured maximum message length. All users should upgrade to this version.</p> <p>### Workarounds</p> <p>No known workarounds exist.</p> <p>### Acknowledgements</p> <p>This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.</p> <p><strong>Affected:</strong> npm: websocket-driver</p> <p>### Impact</p> <p>The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values `0x80` or above, a client can make the server parse these bytes into an ever-growing integer. Since JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly.</p> <p>### Patches</p> <p>The issue has been patched in version 0.7.5 by rejecting the message if the length header exceeds the configured maximum message length. All users should upgrade to this version.</p> <p>### Workarounds</p> <p>No known workarounds exist.</p> <p>### Acknowledgements</p> <p>This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.</p> https://vulnerability.circl.lu/vuln/ghsa-xv26-6w52-cph6