CVE-2016-10542: Denial of Service in ws
Summary
CVE-2016-10542: DoS due to excessively large websocket message in ws. Affects ws versions < 1.1.1. Fixed in 1.1.1. How to fix ↓
Also tracked for
- node-ws · Debian:11
The same CVE-2016-10542 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'ws' package is an npm package used for WebSocket implementation in Node.js. It provides a simple and efficient way to create WebSocket servers and clients. WebSocket is a communication protocol that provides full-duplex communication channels over a single TCP connection. The 'ws' package is widely used in various applications for real-time communication between the server and clients.
Vulnerability Detail
The vulnerability, identified as CVE-2016-10542, affects certain versions of the 'ws' package. It arises from the package's failure to properly limit the size of incoming WebSocket payloads. As a result, an attacker can send excessively large WebSocket messages, causing the node process to crash and resulting in a denial of service (DoS) condition. This vulnerability has a high severity rating and can lead to service disruption and unavailability.
How To Fix
Latest published version: 8.22.0 as of 22 Oct 2026
npm install ws@8.22.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.1
This is the first release that contains the fix.
npm install ws@1.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the 'ws' package is not immediately possible, a temporary workaround can be implemented by setting the 'maxpayload' option for the 'ws' server to a smaller value. For example, the following code snippet demonstrates how to set the 'maxpayload' option to 10MB:
const WebSocket = require('ws');
const wss = new WebSocket.Server({
maxPayload: 10 * 1024 * 1024 // 10MB
});
Conclusion
In conclusion, the 'ws' package is vulnerable to a denial of service (DoS) attack due to its failure to limit the size of incoming WebSocket payloads. To mitigate this vulnerability, it is crucial to update the package to version 1.1.1 or later. Alternatively, the 'maxpayload' option can be adjusted to limit the payload size. Prompt action is recommended to prevent service disruption and ensure the security of the application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ws →
FAQ
The vulnerability allows an attacker to send excessively large WebSocket messages, causing the node process to crash and resulting in a denial of service (DoS) condition. This can lead to service disruption and unavailability.
The vulnerability affects versions of the 'ws' package prior to version 1.1.1.
If updating the 'ws' package is not feasible, you can set the 'maxpayload' option for the 'ws' server to a value smaller than 256MB. This will limit the size of incoming WebSocket payloads and reduce the risk of a DoS attack.
There are no known public exploits specifically targeting this vulnerability at the moment. However, it is important to promptly update the 'ws' package or apply the recommended workaround to mitigate the risk.
You can find more information about this vulnerability, including the advisory and fix details, in the GitHub Security Advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-6663-c963-2gqg/GHSA-6663-c963-2gqg.json
Related vulnerabilities
Recent vulnerabilities recorded for ws.
