CVE-2016-10544: Denial of Service in uws
Summary
CVE-2016-10544: Denial of Service in uws. Affects uws versions >= 0.10.0, < 0.10.9. Fixed in 0.10.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The uws package is an npm package that provides WebSocket functionality for Node.js applications. It allows developers to create WebSocket servers and clients, enabling real-time communication between the server and the client. The package is widely used in various applications and frameworks.
Vulnerability Detail
Affected versions of uws do not properly handle large websocket messages when permessage-deflate is enabled, which may result in a denial of service condition. When uws receives a 256Mb websocket message with permessage-deflate enabled, the server compresses the message before executing the length check. However, the message is then extracted prior to processing, which can lead to a situation where an excessively large websocket message passes the length checks but exceeds v8's maximum string size when cast from a Buffer to a string. This can crash the process, causing a denial of service.
How To Fix
Latest published version: 200.0.0 as of 22 Oct 2026
npm install uws@200.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.10.9
This is the first release that contains the fix.
npm install uws@0.10.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not feasible, you can disable permessage-deflate by modifying the WebSocket server configuration. Here's an example of how to disable permessage-deflate using the uws package:
const uws = require('uws');
const server = new uws.Server({
perMessageDeflate: false
});
// Rest of the server code
Conclusion
The uws package is vulnerable to a denial of service issue when handling large websocket messages with permessage-deflate enabled. It is crucial to update to version 0.10.9 or later to fix this vulnerability. If updating is not possible, disabling permessage-deflate can serve as a workaround. For more information and support, reach out to DevNack.com.
See every vulnerability recorded for uws →
FAQ
This vulnerability can lead to a denial of service condition in applications that use the affected versions of the uws package. An attacker can send a large websocket message that crashes the process, causing the application to become unresponsive.
Versions of uws up to and including 0.10.8 are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the tool will analyze it for any open-source vulnerabilities, including this one.
Yes, you can disable permessage-deflate in the WebSocket server configuration to mitigate this vulnerability. Refer to the 'workaround' section for more details.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
