security: CVE-2026-45736 - ws - Uninitialized memory disclosure in @archastro/channel-harness

[calvin-archastro]

CVE-2026-45736 — ws: Uninitialized Memory Disclosure

CVE: CVE-2026-45736 / GHSA-58qx-3vcg-4xpx
Published: 2026-05-18 (published today — first detected in 2026-05-18T20:00Z scan)

---

Package

Field	Value
Package	ws (npm)
Current constraint	"^8.18.0" in packages/channel-harness/package.json
Vulnerable range	ws 8.0.0 – 8.20.0
Fixed version	ws@8.20.1

---

Severity

MODERATE (CVSS:3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N)

Per the internal Patch Management Standard, MODERATE vulnerabilities require remediation within 30 days. Can be batched with the yaml fix (CVE-2026-33532) from #19.

---

Vulnerability Detail

The websocket.close() implementation discloses uninitialized memory when a TypedArray is passed as the reason argument. The close frame's payload is populated with raw memory rather than zeroed-out bytes.

Note from upstream: "Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice."

---

Affected Code

packages/channel-harness/package.json:

"dependencies": {
  "ws": "^8.18.0"  // resolves to vulnerable range <= 8.20.0
}

Previously the ^8.18.0 constraint addressed CVE-2024-37890 (fixed in 8.17.1), but it is still in the vulnerable range for CVE-2026-45736 (fixed in 8.20.1).

---

Recommended Action

1. In packages/channel-harness/package.json, change "ws": "^8.18.0" → "ws": "^8.20.1"
2. Run npm install to regenerate lockfile
3. Bump package version and publish

Can be batched with the yaml fix from #19.

---

Mitigations in Place

• Requires a TypedArray to be passed as the close reason — unusual usage. String reasons not affected.
• channel-harness is a testing/CI tool, not a production server — actual exploitability is very low.

---

Detected by automated security scan at 2026-05-18T20:00Z. See also: archastro-openapi#19 (CVE-2026-33532 yaml, same package set).