An uninitialized memory disclosure exists in the ws library’s websocket.close() routine when a TypedArray is supplied as the reason parameter. The flaw stems from improper handling of typed array buffers, allowing an attacker to read portions of memory that were not explicitly initialized. As a result, confidential data such as cryptographic keys, credentials, or other sensitive information may be exposed through the node process. The weakness aligns with CWE‑908, which denotes uninitialized data usage.

Websockets:ws, the open‑source WebSocket client and server for Node.js, is affected. Versions earlier than 8.20.1 are vulnerable, including 8.19.x and any prior releases. Any project that imports or requires the ws module and employs the close() method with a TypedArray argument is susceptible. The issue is confined to the library itself and does not propagate to the underlying Node.js runtime outside of the application scope.

The CVSS score of 4.4 indicates a medium severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting limited current exploitation activity. Nonetheless, the exposure is local to the running Node.js process, so the attack requires access to the process internal memory or an attacker who can influence the code path that invokes the vulnerable function. The potential impact is data leakage rather than full compromise.