CVE-2016-10542 DoS due to excessively large websocket message in ws
An attacker can crash the Node.js process by sending an overly long WebSocket payload to a server using the ws library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10542?
CVE-2016-10542 is a high-severity denial of service vulnerability in HackerOne ws node module, published on 31 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
Which versions are affected by CVE-2016-10542?
2 open source packages ship an affected version, including ws. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ws npm | All versions | 1.1.1 |
ws npm | All versions | 1.1.1 |
Products include Ws Project Ws.
How do I fix CVE-2016-10542?
Upgrade ws to 1.1.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2016-10542 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-10542 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in HackerOne ws node module
Sources
Also known as CLSA-2026-1784596294, CVE-2016-1000025, DEBIAN-CVE-2016-10542, GHSA-6663-c963-2gqg, MINI-2chg-g267-phx8, MINI-9wj4-66hj-xhx9 and 1 more.