The vulnerability is located in the websockets:ws library before version 8.21.1, where the fragment guard only activates when the number of fragments reaches maxFragments. An attacker can therefore send a WebSocket frame with FIN=0 followed by continuation frames that never close the fragment chain, leading to each fragment being stored as a Buffer object. This uncontrolled allocation can grow rapidly, exhausting heap space and causing the Node.js application that uses the library to crash. The flaw is an uncontrolled resource consumption issue identified as CWE‑770.

All installations of the websockets:ws package that use the default maxFragments value and have not been updated to 8.21.1 or newer are vulnerable. These are Node.js applications that depend on this library and support WebSocket connections.

The CVSS score of 8.7 classifies this issue as high severity, while the EPSS score of < 1% indicates a very low but non‑zero probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Attackers would normally need to initiate a WebSocket connection to the vulnerable server, thereby using a legitimate communication channel; therefore the attack vector is likely Remote, Network. The impact is confined to service availability, as the hacker can make the process crash by exhausting memory.