CVE-2016-10542 DoS due to excessively large websocket message in ws
HighCVSS 7.5
EPSS 7.3%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm ws(npm) | < 1.1.1 | 1.1.1 |
| debian/node-ws(Debian:12) | < 1.1.0+ds1.e6ddaae4-5 | 1.1.0+ds1.e6ddaae4-5 |
| debian/node-ws(Debian:14) | < 1.1.0+ds1.e6ddaae4-5 | 1.1.0+ds1.e6ddaae4-5 |
| debian/node-ws(Debian:13) | < 1.1.0+ds1.e6ddaae4-5 | 1.1.0+ds1.e6ddaae4-5 |
| ws project ws | <= 1.1.0 | No fix listed |
| HackerOne ws node module | = <=1.1.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com issue-tracking third-party-advisory
- github.com
- www.npmjs.com
- Debian Security Tracker CVE-2016-10542 vendor-advisory
- bugs.debian.org issue-tracking
- nodesecurity.io third-party-advisory