CVE-2017-16025: Denial of Service in nes
Summary
CVE-2017-16025: Denial of Service in nes. Affects nes versions < 6.4.1. Fixed in 6.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nes package is an npm package that provides a WebSocket client and server implementation for Node.js. It allows developers to create real-time applications by enabling bidirectional communication between the client and server. The package is widely used in various Node.js applications.
Vulnerability Detail
The vulnerability identified as CVE-2017-16025 affects versions of nes up to and including 6.4.0. When an invalid cookie header is provided and WebSocket authentication is set to cookie, it can lead to a denial of service (DoS) attack. If an invalid cookie is submitted in the WebSocket upgrade request, the node process will throw an error and exit. This vulnerability can be exploited by an attacker to disrupt the availability of the affected application.
How To Fix
Minimum fixed version
6.4.1
This is the first release that contains the fix.
npm install nes@6.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The nes package is vulnerable to a denial of service attack when an invalid cookie header is provided and WebSocket authentication is set to cookie. It is crucial to update to version 6.4.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nes →
FAQ
The vulnerability allows an attacker to cause a denial of service by submitting an invalid cookie in the WebSocket upgrade request, leading to the node process throwing an error and exiting.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your package-lock.json file without any signup or installation.
No, there is no specific workaround mentioned for this vulnerability. It is recommended to update to the latest version of the nes package.
There are no known exploits available for this vulnerability at the moment.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-3pwh-5mmc-mwrx/GHSA-3pwh-5mmc-mwrx.json
