Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhmNWgtaGg1Ni0zdnJn

Denial of Service in uws

Affected versions of uws do not properly handle large websocket messages when permessage-deflate is enabled, which may result in a denial of service condition.

If uws recieves a 256Mb websocket message when permessage-deflate is enabled, the server will compress the message prior to executing the length check, and subsequently extract the message prior to processing. This can result in a situation where an excessively large websocket message passes the length checks, yet still gets cast from a Buffer to a string, which will exceed v8's maximum string size and crash the process.

Recommendation

Update to version 0.10.9 or later.

Alternatively, disable permessage-deflate.

Permalink: https://github.com/advisories/GHSA-hf5h-hh56-3vrg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhmNWgtaGg1Ni0zdnJn
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 4 years ago
Updated: about 2 years ago

EPSS Percentage: 0.00098
EPSS Percentile: 0.41882

Identifiers: GHSA-hf5h-hh56-3vrg, CVE-2016-10544
References:

• https://github.com/uWebSockets/uWebSockets/commit/37deefd01f0875e133ea967122e3a5e421b8fcd9
• https://www.npmjs.com/advisories/149
• https://nvd.nist.gov/vuln/detail/CVE-2016-10544
• https://github.com/advisories/GHSA-hf5h-hh56-3vrg

Repository: https://github.com/uWebSockets/uWebSockets
Blast Radius: 0.0

Affected Packages