ws, the open‑source WebSocket client and server for Node.js, has a flaw in its websocket.close() implementation. When a TypedArray is passed as the reason argument, the function accesses uninitialized memory, allowing an attacker to read data that was never explicitly set. This can lead to the leak of sensitive information such as cryptographic keys, credentials, or other confidential data. The weakness is represented by CWE‑824 (Uninitialized Data Read) and CWE‑908 (Uninitialized Memory Access).

The vulnerability affects all releases of ws earlier than version 8.20.1, including the 8.19.x line and any prior releases. Applications that import or require the ws module and use the close() method with a TypedArray argument are susceptible. The issue is confined to the library itself and does not affect the underlying Node.js runtime beyond the application scope.

The CVSS score of 4.4 indicates a medium severity. The EPSS score of <1% shows a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog, further suggesting limited current exploitation activity. The exposure is local to the running Node.js process; an attacker would need the ability to influence the code path that triggers websocket.close() or have access to the process memory. Consequently, the impact is primarily data leakage rather than a full compromise of the system.