Packages / ws / Security

HighVulnerabilityGHSA-6663-c963-2gqgCVE-2016-10542Published 18 Feb 2019

DoS due to excessively large websocket message in ws

Affected releases · ws

  • 1.x1.0.0 – 1.1.0Fixed in 1.1.1
  • 0.8.x and older0.2.6 – 0.8.1No fix, no longer updated

On 1.x, the newest line:

npm install ws@1.1.1
8.x

  1. Not affected

    8.0.0 – 8.22.0

    41 releases, latest

1.x

  1. Affected

    1.0.0 – 1.1.0

    3 releases

  2. Fixed

    1.1.1 – 1.1.5

    5 releases

0.x

  1. Affected

    0.2.6 – 0.8.1

    58 releases

184 stable releases of ws, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for ws. It is read in your browser and sent nowhere.

What happens

Affected versions of ws do not appropriately limit the size of incoming websocket payloads, which may result in a denial of service condition when the node process crashes after receiving a large payload.

Recommendation

Update to version 1.1.1 or later. Alternatively, set the maxpayload option for the ws server to a value smaller than 256MB.