CVE-2020-7662 Regular Expression Denial of Service in websocket-extensions (NPM package)
An attacker can cause a Denial of Service in applications using the websocket-extensions library by sending a malicious Sec-WebSocket-Extensions header that triggers quadratic regex backtracking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7662?
CVE-2020-7662 is a high-severity denial of service vulnerability in websocket-extensions (npm), published on 2 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.
Which versions are affected by CVE-2020-7662?
2 open source packages ship an affected version, including websocket-extensions. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
websocket-extensions npm | All versions | 0.1.4 |
websocket-extensions npm | All versions | 0.1.4 |
Products include Websocket-Extensions Project Websocket-Extensions.
How do I fix CVE-2020-7662?
Upgrade websocket-extensions to 0.1.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-7662 being exploited?
There is no known exploitation of CVE-2020-7662 in the wild and no public exploit code.
Sources
Also known as AZL-44202, CLSA-2026-1773188138, GHSA-g78m-2chm-r7qv, SNYK-JS-WEBSOCKETEXTENSIONS-570623.