CVE-2026-54490

Name of the Vulnerable Software and Affected Versions websocket-driver versions prior to 0.7.5

Description When used with the permessage-deflate extension, a WebSocket server or client may accept messages exceeding the configured maximum message size. This occurs because the size limit is validated against the length headers of message frames, which represent the compressed data size rather than the size after decompression in lib/websocket/driver/hybi.js. Consequently, applications may process larger messages than intended, leading to excessive resource usage.

Recommendations Update to version 0.7.5.