CVE-2026-45736 #5500

Activity

1. mateBe95

   added

   to triageWaiting to be triaged by a member of the teamWaiting to be triaged by a member of the team

   on May 19, 2026
2. NormandoHall commented on May 19, 2026

   

   NormandoHall

   on May 19, 2026

   More actions

   Link: GHSA-58qx-3vcg-4xpx
3. AviVahl commented on May 19, 2026

   

   AviVahl

   on May 19, 2026

   Contributor

   More actions

   #5439
   No response from author, though...
4. NormandoHall commented on May 19, 2026

   

   NormandoHall

   on May 19, 2026

   Last edited by NormandoHall

   More actions

   #5439 No response from author, though...

   Meanwhile add to package.json

     "overrides": {
       "ws": "8.20.1"
     }

   Then npm i

   👍React with 👍1Reacted by Paul-Emile
5. chadlwilson commented on May 20, 2026

   

   chadlwilson

   on May 20, 2026

   More actions

   This is merged/fixed via #5439 now; pending release.

   👍React with 👍1Reacted by Normando Hall
6. darrachequesne commented on May 20, 2026

   

   darrachequesne

   on May 20, 2026

   Member

   More actions

   New releases which use ws@~8.20.1:

   • engine.io@6.6.8: https://github.com/socketio/socket.io/releases/tag/engine.io%406.6.8
   • engine.io-client@6.6.5: https://github.com/socketio/socket.io/releases/tag/engine.io-client%406.6.5
   • socket.io-adapter@2.5.7: https://github.com/socketio/socket.io/releases/tag/socket.io-adapter%402.5.7

   Thanks for the heads-up 👍

   🚀React with 🚀2Reacted by Avi Vahl and Chad Wilson
7. darrachequesne

   closed this as completedon May 20, 2026
8. darrachequesne

   removed

   to triageWaiting to be triaged by a member of the teamWaiting to be triaged by a member of the team

   on May 20, 2026
9. 3makkk

   added 2 commits that reference this issue on Jul 14, 2026

   fix(deps): resolve dependabot security alerts in transitive deps

   ...

   fe1c852

   fix(deps): resolve 9 dependabot security alerts (lockfile refresh) (#138

   ...

   18e1a24