json-rpc2-2.0.0.tgz: 2 vulnerabilities (highest severity is: 8.6)

[mend-bolt-for-github]

Vulnerable Library - json-rpc2-2.0.0.tgz

Path to dependency file: /src/ui/package.json

Path to vulnerable library: /src/ui/node_modules/websocket-driver/package.json

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (json-rpc2 version)	Remediation Possible**
CVE-2026-54466	High	8.6	websocket-driver-0.7.4.tgz	Transitive	N/A*	❌
CVE-2026-54490	Medium	5.8	websocket-driver-0.7.4.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-54466

Vulnerable Library - websocket-driver-0.7.4.tgz

WebSocket protocol handler with pluggable I/O

Library home page: https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.4.tgz

Path to dependency file: /src/ui/package.json

Path to vulnerable library: /src/ui/node_modules/websocket-driver/package.json

Dependency Hierarchy:

• json-rpc2-2.0.0.tgz (Root Library)
  • faye-websocket-0.11.4.tgz
    • ❌ websocket-driver-0.7.4.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer in lib/websocket/driver/draft75.js; because JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly. This issue is fixed in version 0.7.5.

Publish Date: 2026-07-17

URL: CVE-2026-54466

CVSS 3 Score Details (8.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xv26-6w52-cph6

Release Date: 2026-07-15

Fix Resolution: websocket-driver - 0.7.5

Step up your Open Source Security Game with Mend here

CVE-2026-54490

Vulnerable Library - websocket-driver-0.7.4.tgz

WebSocket protocol handler with pluggable I/O

Library home page: https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.4.tgz

Path to dependency file: /src/ui/package.json

Path to vulnerable library: /src/ui/node_modules/websocket-driver/package.json

Dependency Hierarchy:

• json-rpc2-2.0.0.tgz (Root Library)
  • faye-websocket-0.11.4.tgz
    • ❌ websocket-driver-0.7.4.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.

Publish Date: 2026-07-17

URL: CVE-2026-54490

CVSS 3 Score Details (5.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-mp7j-qc5w-4988

Release Date: 2026-07-15

Fix Resolution: websocket-driver - 0.7.5

Step up your Open Source Security Game with Mend here