The vulnerability in the websocket-driver library allows a WebSocket server or client that uses the permessage-deflate extension to accept compressed messages larger than the configured maximum message size. The size check is performed against the compressed frame length, not the decompressed length. This means an attacker can send a small compressed payload that expands to a large size, causing the application to process data beyond its intended resource limits. The flaw is a classic case of Resource Exhaustion (CWE-770) and can degrade availability or lead to memory-based denial of service if the consumption becomes excessive.

The affected product is the Faye WebSocket Driver Node library, known as websocket-driver-node. Versions older than 0.7.5 are vulnerable; the fix was introduced in 0.7.5. Applications that depend on this library in server or client mode and use permessage-deflate must ensure they are running an updated version.

CVSS score of 6.3 indicates moderate severity, and the EPSS score of <1% shows a low probability of exploitation at this time. The vulnerability is not yet listed in CISA’s KEV. The likely attack vector involves a malicious client or server injecting compressed WebSocket frames that decompress to a size exceeding the server’s allowed maximum. By exploiting this flaw, an attacker could trigger high memory consumption or other resource exhaustion, potentially resulting in service degradation or denial of service. This can be performed over the network without authentication if the WebSocket endpoint is exposed, making it a realistic threat for publicly reachable services.