CVE-2026-45736 — ws is an open source WebSocket client and server for

title: CVE-2026-45736 - Uninitialized Memory Disclosure via ws WebSocket close()
id: scw-2026-05-15-ai-1
status: experimental
level: medium
description: |
  Detects the specific exploitation pattern of CVE-2026-45736 where an attacker attempts to trigger an uninitialized memory disclosure by passing a TypedArray (like Uint8Array) to the websocket.close() function in vulnerable versions of the 'ws' Node.js library. This rule looks for the Node.js executable being run with a command line that includes both 'websocket.close()' and a reference to a TypedArray constructor, indicating a potential exploit attempt.
author: SCW Feed Engine (AI-generated)
date: 2026-05-15
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-45736/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: process_creation
detection:
  selection:
      Image|startswith:
          - 'C:\Program Files
  odejs
  ode.exe'
      CommandLine|contains:
          - 'websocket.close()'
      CommandLine|contains:
          - 'new Uint8Array()'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse