In breve
- CVE-2016-10542 è una vulnerabilità ALTO (CVSS 7.5) che riguarda ws (ws project), ws.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 7.4%, superiore al 94.5% delle vulnerabilità.
- Correzione: aggiornare a 1.1.1 o successiva.
| Package | Affected versions | Patched versions |
|---|
| ws | ≤ 1.1.0
| No fix yet |
| ws npm | < 1.1.1
| 1.1.1
|
Description
Affected versions of ws do not appropriately limit the size of incoming websocket payloads, which may result in a denial of service condition when the node process crashes after receiving a large payload.
Recommendation
Update to version 1.1.1 or later.
Alternatively, set the maxpayload option for the ws server to a value smaller than 256MB.
NVD description
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free