GitHub Advisoryadvisory · npm

GHSA-vw3h-q6xq-jjm5 OpenClaw: Voice-call realtime WebSocket accepted oversized frames

HIGH Published 2026-04-17 Modified 2026-06-08 Official page ↗
Aliases
CVE-2026-42437
Ecosystem
npm
Packages
openclaw
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-770
Reviewed
2026-04-17

Affected packages

• npm openclaw: >= 2026.4.9, < 2026.4.10 → fixed in 2026.4.10

Description

Summary Voice-call realtime WebSocket accepted oversized frames. Affected Packages / Versions • Package: `openclaw` • Ecosystem: npm • Affected versions: `>= 2026.4.9 = 2026.4.10` Impact The voice-call realtime WebSocket path could accept oversized frames, creating a remote availability risk for deployments exposing that webhook path. Technical Details The fix rejects oversized realtime WebSocket frames before processing them. Fix The issue was fixed in #63890. The first stable tag containing the fix is `v2026.4.10`, and `[email protected]` includes the fix. Fix Commit(s) • `afadb7dae6738819ad9c7d2597ace0516957d20e` • PR: #63890 Release Process Note Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix. Reporters Thanks to G0odUser from ADLab of VenusTech Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

Related

Alias · CVE (1)

  • CVE-2026-42437 OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that… vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References