The WebSocket driver for Node.js before version 0.7.5 is vulnerable to a format‑length header abuse that allows a client to send an arbitrary long sequence of bytes with the high bit set. The server will interpret these bytes as an ever‑growing integer; when JavaScript’s 64‑bit floating‑point numbers lose precision, the payload is parsed incorrectly, potentially corrupting the message stream or causing the processing loop to fail. This flaw, identified as CWE‑130 (Numeric precision loss), can allow an attacker to disrupt correct packet parsing and achieve a denial of service outcome.

All installations of the Faye websocket‑driver for Node.js that use versions prior to 0.7.5 are affected. The vulnerability applies to any Node.js application that imports the driver without a patch to the 0.7.5 release or later.

The vulnerability carries a CVSS score of 9.2, indicating a high severity risk. The EPSS score of less than 1% suggests a low current likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. Exploitation would typically occur via a malicious WebSocket client that sends payloads with excessive high‑bit bytes, targeting servers that accept WebSocket connections. Successful exploitation leads to corrupted data handling and caused service disruption.