Spotted what might be an issue in demos/react16/package-lock.json around line 3558.
CVE-2026-54466 is a critical vulnerability in websocket-driver where crafted WebSocket frames containing oversized length headers trigger integer overflow and floating-point precision loss during draft75.js parsing. This causes incorrect payload processing, potentially leading to Denial of Service, state corruption, or bypassing security controls. The installed version 0.7.4 lacks bounds checking for these header values and is immediately exploitable.
Something like this might fix it:
--- a/demos/react16/package.json
+++ b/demos/react16/package.json
@@ -10,7 +10,7 @@
"dependencies": {
- "websocket-driver": "0.7.4",
+ "websocket-driver": "^0.7.5",
...
}
}
Apply this change and run `cd demos/react16 && npm install` to regenerate package-lock.json with the patched version.For reference: rule CVE-2026-54466. Rated critical.
If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
demos/react16/package-lock.jsonaround line 3558.CVE-2026-54466 is a critical vulnerability in websocket-driver where crafted WebSocket frames containing oversized length headers trigger integer overflow and floating-point precision loss during draft75.js parsing. This causes incorrect payload processing, potentially leading to Denial of Service, state corruption, or bypassing security controls. The installed version 0.7.4 lacks bounds checking for these header values and is immediately exploitable.
Something like this might fix it:
For reference: rule
CVE-2026-54466. Rated critical.If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.