Hi,

The following vulnerability was published for node-ws.

CVE-2026-62389[0]:
| ws before 8.21.1 contains a memory exhaustion vulnerability in
| lib/receiver.js where the fragment guard only triggers when fragment
| count reaches maxFragments, allowing attackers to exhaust memory by
| sending incomplete fragmented WebSocket messages. Attackers can send
| a text frame with FIN=0 followed by continuation frames without
| completing the sequence, causing each fragment to be stored as a
| separate Buffer object with significant overhead, enabling denial of
| service through heap exhaustion.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-62389
https://www.cve.org/CVERecord?id=CVE-2026-62389
[1] https://github.com/websockets/ws/issues/2331
[2] https://github.com/websockets/ws/commit/f197ac65140920bdcecdab74bfc69c2d7858e55d

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hello,

Bug #1142271 in node-ws reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-ws/-/commit/6c58948d72b4b820494bddb65ce66f0977cc8981

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1142271

Hello,

Bug #1142271 in node-ws reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-ws/-/commit/6c58948d72b4b820494bddb65ce66f0977cc8981

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1142271

We believe that the bug you reported is fixed in the latest version of
node-ws, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142271@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Xavier Guimard <yadd@debian.org> (supplier of updated node-ws package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 17 Jul 2026 11:07:20 +0200
Source: node-ws
Architecture: source
Version: 8.21.1+~cs14.19.1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Xavier Guimard <yadd@debian.org>
Closes: 1142271
Changes:
 node-ws (8.21.1+~cs14.19.1-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream version (Closes: #1142271, CVE-2026-62389)
Checksums-Sha1:
 20d6b9f608ade53292ec101b1ecb893650ef764a 2925 node-ws_8.21.1+~cs14.19.1-1.dsc
 48464e4bf2ddfd17db13d845467f6070ffea4aa9 6013 node-ws_8.21.1+~cs14.19.1.orig-types-ws.tar.gz
 4e0d6933802ccb18f663fd109c9e93a035859add 5016 node-ws_8.21.1+~cs14.19.1.orig-wscat.tar.gz
 3818a3d4d75f5b2073609ff6e96428066b3930ce 88634 node-ws_8.21.1+~cs14.19.1.orig.tar.gz
 14b99184862b926eb9cc1b3e0ad2fa8a022b7534 5412 node-ws_8.21.1+~cs14.19.1-1.debian.tar.xz
Checksums-Sha256:
 70454fc5774f398999176f7e1d607703b14087044933412feaaaf1defb832a73 2925 node-ws_8.21.1+~cs14.19.1-1.dsc
 dc2763952a24bf15dc920830a2d2884c23bccc08a853e8556e34771401254fa5 6013 node-ws_8.21.1+~cs14.19.1.orig-types-ws.tar.gz
 a779225d92fcceade8db9831b0f9f0830b2b20216e79f5fd303941817a267fe4 5016 node-ws_8.21.1+~cs14.19.1.orig-wscat.tar.gz
 c6161ea6d989ec3c9a95d5a16a81c13cd2dd63501cf0793787c7cc02eb9a2865 88634 node-ws_8.21.1+~cs14.19.1.orig.tar.gz
 951d640db62578c20a80d2af4e24a7a83401a5bf527cedd8734c544f5a93a32e 5412 node-ws_8.21.1+~cs14.19.1-1.debian.tar.xz
Files:
 ca61a83705fd3f6f526c73a047f97198 2925 javascript optional node-ws_8.21.1+~cs14.19.1-1.dsc
 b36d8736035a3f5c7b2fb62b2fbeca1a 6013 javascript optional node-ws_8.21.1+~cs14.19.1.orig-types-ws.tar.gz
 1ffc9b580c625f627939368a5c535c8a 5016 javascript optional node-ws_8.21.1+~cs14.19.1.orig-wscat.tar.gz
 a3a8a52943bdbb5bea0f53aee69bb349 88634 javascript optional node-ws_8.21.1+~cs14.19.1.orig.tar.gz
 eb2354160d3fcced16cc8fadff871272 5412 javascript optional node-ws_8.21.1+~cs14.19.1-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmpZ8ScACgkQ9tdMp8mZ
7umPdQ//c+68YI8+0MPaajb9l0/3cVoxdNCZVD7I6Nn3PljtCg/qbrB5YwzSWG3o
tRA5UDKepZQcjEQ9q6gTZXSanfu5D8aM1fqhc+Xc/l9DcY4EMXdnDQv+KvXK3XZC
rZjCEB/RZ8bF6UHuQlx4pNOyRe5lemSVFN0zCNS57ioYp9YsbevSzGdMY2FPyUny
aPiRNazTluFlpzDJuVJDJPz+uPF5J2J6FsTzdKHnrenWUQgI+iV9rwrXy15c1HYe
XId3QsHAit+Ea73tWSxtP9RRnCoozdfBIZ7J2DYIB1RGBZf8Ag8sL3PJ1tS+xHC7
CGIStn0gJ/2sjLwk7Uu0kj1V2ZXvCIhrs62KMw/54lecadfOz83KpbIDFNubsKbL
jNjUm+1LKdLBmLNVC2hINb/5aX01MLPQiIY3Hwpuaqg0v6cL1Z9+roy9YRWmbH+F
p0gLmDslxJJRW+Rs4XmUgXDHq4DK/bknrZqw2AOCapUWcrSvh0/0Hg5+M2wpSZBH
FCEjwEcD/PiB1Lgp+aE/sNwAnxWmVd7e9DoO67bUBxFJomUfNk6FBctpMGO0rwdW
csK6TpQt1CQZM5VMTU2L0M0nhPX3kFw325QQwYqfzEhx9534Ixm4PKdDtVi/HDBK
+KlY3cncGQ1FIIIbi1w6eG6rZcN6brTDkU0F/Fmmv9Iskga6bPM=
=b6k2
-----END PGP SIGNATURE-----