OCPBUGS-91731: Fix CVE-2026-45736 ws uninitialized memory disclosure via websocket.close()

[jrangelramos]

Analysis / Root cause

ws (WebSocket client and server for Node.js) versions prior to 8.20.1 are vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument to websocket.close() (CVE-2026-45736).

The package is a transitive dependency in the console frontend at version 8.20.0, pulled in by @kubernetes/client-node, jsdom, puppeteer-core, and webpack-dev-server.

Solution description

Add scoped yarn resolutions for ws@^8.18.0 and ws@^8.18.2 to >=8.20.1 in frontend/package.json. This bumps only the 8.x consumers to the patched version while leaving 5.x (subscriptions-transport-ws) and 7.x (webpack-bundle-analyzer) consumers on their respective major versions.

Screenshots / screen recording

N/A — dependency version bump only, no visual changes.

Test setup

No special setup required.

Test cases

• yarn install completes without errors
• Development build (webpack --mode=development) succeeds (986 assets, 20219 modules)
• All websocket/k8s related unit tests pass (17 suites, 158 tests)
• ws@5.x and ws@7.x consumers are not affected by the resolution

Browser conformance

N/A — no runtime behavior changes beyond the security fix.

Additional info

• Jira: OCPBUGS-91731
• CVE: CVE-2026-45736
• Upstream fix: ws v8.20.1
• Bugzilla: BZ#2477914

Summary by CodeRabbit

• Chores
  • Updated package resolution rules to pin a newer compatible version of a transitive websocket dependency, helping avoid known issues and improve stability.

[openshift-ci-robot]

@jrangelramos: This pull request references Jira Issue OCPBUGS-91731, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Analysis / Root cause

ws (WebSocket client and server for Node.js) versions prior to 8.20.1 are vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument to websocket.close() (CVE-2026-45736).

The package is a transitive dependency in the console frontend at version 8.20.0, pulled in by @kubernetes/client-node, jsdom, puppeteer-core, and webpack-dev-server.

Solution description

Add scoped yarn resolutions for ws@^8.18.0 and ws@^8.18.2 to >=8.20.1 in frontend/package.json. This bumps only the 8.x consumers to the patched version while leaving 5.x (subscriptions-transport-ws) and 7.x (webpack-bundle-analyzer) consumers on their respective major versions.

Screenshots / screen recording

N/A — dependency version bump only, no visual changes.

Test setup

No special setup required.

Test cases

• yarn install completes without errors
• Development build (webpack --mode=development) succeeds (986 assets, 20219 modules)
• All websocket/k8s related unit tests pass (17 suites, 158 tests)
• ws@5.x and ws@7.x consumers are not affected by the resolution

Browser conformance

N/A — no runtime behavior changes beyond the security fix.

Additional info

• Jira: OCPBUGS-91731
• CVE: CVE-2026-45736
• Upstream fix: ws v8.20.1
• Bugzilla: BZ#2477914

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jrangelramos
Once this PR has been reviewed and has the lgtm label, please assign rawagner for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• frontend/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Warning

Review limit reached

@jrangelramos, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 24 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1eac0bc1-e60b-4176-a4ff-22a63aad2bc9

📥 Commits

Reviewing files that changed from the base of the PR and between 43a97cd and e5b26c9.

⛔ Files ignored due to path filters (1)

• frontend/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• frontend/package.json

Walkthrough

This change updates frontend/package.json to add two ws package resolution overrides, forcing dependency resolvers to use ws version >=8.20.1 for both ws@^8.18.0 and ws@^8.18.2 ranges within the existing resolutions block.

Changes

Dependency Resolution Update

Layer / File(s)	Summary
ws resolution overrides frontend/package.json	Adds two entries to the resolutions block forcing ws@^8.18.0 and ws@^8.18.2 to resolve to >=8.20.1.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Related PRs: None identified.

Suggested labels: dependencies

Suggested reviewers: None identified.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is specific, concise, and accurately summarizes the security fix for the ws vulnerability.
Description check	✅ Passed	The description is mostly complete and covers root cause, solution, tests, and metadata with concrete details.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The PR only changes frontend/package.json resolutions; no Ginkgo test titles or test files are modified, so there are no dynamic test names to flag.
Test Structure And Quality	✅ Passed	PR only changes frontend/package.json dependency resolutions; no Ginkgo test code is touched, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	PR only changes frontend/package.json ws resolutions; no new Ginkgo e2e tests or MicroShift-unsupported APIs/features were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: Only frontend/package.json changed; no new or modified Ginkgo e2e tests were added, so the SNO compatibility check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Only frontend/package.json resolution changes ws versions; no deployment manifests, operator code, or controller changes introducing scheduling constraints were modified.
Ote Binary Stdout Contract	✅ Passed	Only package.json resolutions changed; no main/init/TestMain/suite setup code was introduced that could write to stdout.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only frontend/package.json changed; no new or modified Ginkgo e2e tests or IPv4/public-network assumptions were added.
No-Weak-Crypto	✅ Passed	PR only edits Yarn ws resolutions in frontend/package.json; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons added.
Container-Privileges	✅ Passed	The PR only changes frontend/package.json, and no container/K8s manifests contain privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only changes Yarn resolutions in frontend/package.json; no logging code or sensitive-data strings appear in the touched diff.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@jrangelramos: This pull request references Jira Issue OCPBUGS-91731, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Analysis / Root cause

ws (WebSocket client and server for Node.js) versions prior to 8.20.1 are vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument to websocket.close() (CVE-2026-45736).

The package is a transitive dependency in the console frontend at version 8.20.0, pulled in by @kubernetes/client-node, jsdom, puppeteer-core, and webpack-dev-server.

Solution description

Add scoped yarn resolutions for ws@^8.18.0 and ws@^8.18.2 to >=8.20.1 in frontend/package.json. This bumps only the 8.x consumers to the patched version while leaving 5.x (subscriptions-transport-ws) and 7.x (webpack-bundle-analyzer) consumers on their respective major versions.

Screenshots / screen recording

N/A — dependency version bump only, no visual changes.

Test setup

No special setup required.

Test cases

• yarn install completes without errors
• Development build (webpack --mode=development) succeeds (986 assets, 20219 modules)
• All websocket/k8s related unit tests pass (17 suites, 158 tests)
• ws@5.x and ws@7.x consumers are not affected by the resolution

Browser conformance

N/A — no runtime behavior changes beyond the security fix.

Additional info

• Jira: OCPBUGS-91731
• CVE: CVE-2026-45736
• Upstream fix: ws v8.20.1
• Bugzilla: BZ#2477914

Summary by CodeRabbit

• Chores
• Updated package resolution rules to pin a newer compatible version of a transitive websocket dependency, helping avoid known issues and improve stability.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@frontend/package.json`:
- Around line 340-341: The package resolution entries for ws are using an
open-ended semver range, which breaks the intended security pinning. Update the
ws resolutions in package.json to an exact patched version instead of
">=8.20.1", and keep the two ws selectors aligned; use the package.json
resolution keys (ws@^8.18.0 and ws@^8.18.2) to locate and replace the values
with a fixed release.
- Around line 340-341: The ws resolution entries in package.json are too loose
because they allow future versions beyond the patched release. Update the
existing ws override selectors to pin both ws@^8.18.0 and ws@^8.18.2 to the
exact patched version used in the repo, and keep the change confined to the
package.json resolutions/overrides block so installs stay deterministic.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a9c24c6e-1c28-42d1-b9e0-9f67055bb349

📥 Commits

Reviewing files that changed from the base of the PR and between 7707540 and 43a97cd.

⛔ Files ignored due to path filters (1)

• frontend/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• frontend/package.json

[openshift-ci]

@jrangelramos: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-console	43a97cd	link	true	/test e2e-gcp-console
ci/prow/backend	43a97cd	link	true	/test backend

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.