Fluid Attacks Database

Description

DoS due to excessively large websocket message in ws Affected versions of ws do not appropriately limit the size of incoming websocket payloads, which may result in a denial of service condition when the node process crashes after receiving a large payload.

Recommendation

Update to version 1.1.1 or later. Alternatively, set the maxpayload option for the ws server to a value smaller than 256MB.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	ws	>=0 <1.1.1	1.1.1
debian 11	node-ws	>=0 <1.1.0+ds1.e6ddaae4-5	1.1.0+ds1.e6ddaae4-5
debian 12	node-ws	>=0 <1.1.0+ds1.e6ddaae4-5	1.1.0+ds1.e6ddaae4-5
debian 14	node-ws	>=0 <1.1.0+ds1.e6ddaae4-5	1.1.0+ds1.e6ddaae4-5
debian 13	node-ws	>=0 <1.1.0+ds1.e6ddaae4-5	1.1.0+ds1.e6ddaae4-5

Aliases

1. CVE-2016-105422. NVD-2016-105423. OSV-2016-105424. OSV-DEBIAN-2016-105425. GHSA-6663-c963-2gqg6. GCVE-2016-105427. SECURITY-TRACKER-CVE-2016-10542

References

1. https://github.com/nodejs/node/issues/73882. https://www.npmjs.com/advisories/120

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.