GHSA-6663-c963-2gqgHigh

DoS due to excessively large websocket message in ws

Published
February 18, 2019
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

📋 Description

Affected versions of ws do not appropriately limit the size of incoming websocket payloads, which may result in a denial of service condition when the node process crashes after receiving a large payload.

Recommendation

Update to version 1.1.1 or later. Alternatively, set the maxpayload option for the ws server to a value smaller than 256MB.

🎯 Affected products1

  • npm/ws:< 1.1.1

🔗 References (4)