| Package | Affected versions | Patched versions |
|---|---|---|
| ws | ≥ 5.0.0, < 6.2.2≥ 7.0.0, < 7.4.6 | 6.2.27.4.6 |
| ws | ≥ 5.0.0, < 5.2.3≥ 6.0.0, < 6.2.2≥ 7.0.0, < 7.4.6 | 5.2.36.2.27.4.6 |
A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server.
for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
const value = 'b' + ' '.repeat(length) + 'x';
const start = process.hrtime.bigint();
value.trim().split(/ *, */);
const end = process.hrtime.bigint();
console.log('length = %d, time = %f ns', length, end - start);
}
The vulnerability was fixed in [email protected] (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff) and backported to [email protected] (https://github.com/websockets/ws/commit/78c676d2a1acefbc05292e9f7ea0a9457704bf1b) and [email protected] (https://github.com/websockets/ws/commit/76d47c1479002022a3e4357b3c9f0e23a68d4cd2).
In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.
The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free