GitHub Advisoryadvisory · npm

GHSA-6663-c963-2gqg DoS due to excessively large websocket message in ws

HIGH Published 2019-02-18 Modified 2020-08-31 Official page ↗
Aliases
CVE-2016-10542
Ecosystem
npm
Packages
ws
Severity
High
Weaknesses
CWE-400
Reviewed
2020-06-16

Affected packages

• npm ws: < 1.1.1 → fixed in 1.1.1

Description

Affected versions of `ws` do not appropriately limit the size of incoming websocket payloads, which may result in a denial of service condition when the node process crashes after receiving a large payload. Recommendation Update to version 1.1.1 or later. Alternatively, set the `maxpayload` option for the `ws` server to a value smaller than 256MB.

Related

Alias · CVE (1)

  • CVE-2016-10542 ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References