VulnSocial

CVE-2026-54466General(faye / websocket-driver)

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer in lib/websocket/driver/draft75.js; because JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly. This issue is fixed in version 0.7.5.

faye CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-130

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • websocket-driver

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • General: 2 classified signals
  • 2 total mentions across 1 day

Affected systems

Vendors
faye
Products
websocket-driver

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-17: 2Technical Details · 2026-07-17: 107-17
Signal classification1 categories
General
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-54466 websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length he… https://www.cve.org/CVERecord?id=CVE-2026-54466 ----- Traducción: CVE-2026-54466 web… http://infoflow.cloud`

    Post summary

    The post simply references CVE-2026-54466 with a link and a brief mention of the frame format, offering no concrete evidence of exploitation, patching, or in-depth technical detail.

    0000037
    92 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-54466 websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length he… https://www.cve.org/CVERecord?id=CVE-2026-54466

    Post summary

    The text provides a brief technical note about CVE‑2026‑54466 but does not disclose a PoC, exploit, patch, or active exploitation, so it is best classified as a general mention.

    000001.2K
    57.8K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appfayewebsocket-driver-ruby-

Explore more

Back to dashboardfaye CVEswebsocket-driver vulnerabilities