GHSA-hf5h-hh56-3vrg

    Dashboard / Vulnerabilities / GHSA-hf5h-hh56-3vrg

    GHSA-hf5h-hh56-3vrg

    Published: 1 Sept 2020Last Modified: 8 Nov 2023

    Summary: Denial of Service in uws

    Details: Affected versions of `uws` do not properly handle large websocket messages when `permessage-deflate` is enabled, which may result in a denial of service condition. If `uws` recieves a 256Mb websocket message when `permessage-deflate` is enabled, the server will compress the message prior to executing the length check, and subsequently extract the message prior to processing. This can result in a situation where an excessively large websocket message passes the length checks, yet still gets cast from a Buffer to a string, which will exceed v8's maximum string size and crash the process. ## Recommendation Update to version 0.10.9 or later. Alternatively, disable `permessage-deflate`.

    References: https://nvd.nist.gov/vuln/detail/CVE-2016-10544, https://github.com/uWebSockets/uWebSockets/commit/37deefd01f0875e133ea967122e3a5e421b8fcd9, https://www.npmjs.com/advisories/149

    Affected packages

    Package

    Name: uws

    Purl: pkg:npm/uws

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.10.0
    Fixed -0.10.9

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High