@⁠forgerock/local-release-tool-0.0.0.tgz: 2 vulnerabilities (highest severity is: 7.5)

[mend-for-github-com]

Vulnerable Library - @⁠forgerock/local-release-tool-0.0.0.tgz

Path to vulnerable library: /package.json

Found in HEAD commit: ee8c7aafbe3b941a4da35bf641d2e93842f23673

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (@⁠forgerock/local-release-tool version)	Remediation Possible**
CVE-2026-48779	High	7.5	ws-8.18.3.tgz	Transitive	N/A*	❌
CVE-2026-45736	Medium	4.4	ws-8.18.3.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-48779

Vulnerable Library - ws-8.18.3.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-8.18.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• @⁠forgerock/local-release-tool-0.0.0.tgz (Root Library)
  • platform-node-0.94.2.tgz
    • ❌ ws-8.18.3.tgz (Vulnerable Library)

Found in HEAD commit: ee8c7aafbe3b941a4da35bf641d2e93842f23673

Found in base branch: main

Vulnerability Details

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.

Publish Date: 2026-06-16

URL: CVE-2026-48779

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-96hv-2xvq-fx4p

Release Date: 2026-06-15

Fix Resolution: ws - 5.2.5,ws - 6.2.4,ws - 7.5.11,ws - 8.21.0

CVE-2026-45736

Vulnerable Library - ws-8.18.3.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-8.18.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• @⁠forgerock/local-release-tool-0.0.0.tgz (Root Library)
  • platform-node-0.94.2.tgz
    • ❌ ws-8.18.3.tgz (Vulnerable Library)

Found in HEAD commit: ee8c7aafbe3b941a4da35bf641d2e93842f23673

Found in base branch: main

Vulnerability Details

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

Publish Date: 2026-05-15

URL: CVE-2026-45736

CVSS 3 Score Details (4.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-58qx-3vcg-4xpx

Release Date: 2026-05-15

Fix Resolution: ws - 8.20.1,https://github.com/websockets/ws.git - 8.20.1