CVE-2016-10544 Denial of Service in uws
Attackers can crash the Node.js process by sending large compressed WebSocket messages, causing resource exhaustion in the uws library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10544?
CVE-2016-10544 is a medium-severity denial of service vulnerability in HackerOne uws node module, published on 31 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used compression will shrink said 256mb down to less than 16mb of websocket payload which passes the length check of 16mb payload. This data will then inflate up to 256mb and crash the node process by exceeding V8's maximum string size. This affects uws >=0.10.0 <=0.10.8.
Which versions are affected by CVE-2016-10544?
2 open source packages ship an affected version, including uws. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
uws npm | From 0.10.0 | 0.10.9 |
uws npm | From 0.10.0 | 0.10.9 |
Products include Uws Project Uws.
How do I fix CVE-2016-10544?
Upgrade uws to 0.10.9 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2016-10544 being exploited?
There is no known exploitation of CVE-2016-10544 in the wild and no public exploit code.
Sources
Also known as GHSA-hf5h-hh56-3vrg.