Critical WebSocket Payload Length Vulnerability in node-ws Package

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

The node-ws package is a widely used WebSocket client and server for Node.js, designed for high performance and compliance with RFC-6455. It allows real-time communication between clients and servers, making it essential for applications requiring instant data exchange. However, versions 1.1.0 and earlier are susceptible to a vulnerability that can crash the Node.js process when an overly long WebSocket payload is sent to the server.

Vulnerability Detail

The vulnerability, identified as CVE-2016-10542, arises from the handling of WebSocket payloads in the node-ws package. By sending a payload that exceeds the expected length, an attacker can cause the Node.js process to crash. This can lead to denial of service, affecting the availability of applications relying on the node-ws package. The issue affects all versions of node-ws up to and including 1.1.0, making it critical for users to upgrade to a patched version to mitigate the risk.

sudo apt-get install --only-upgrade node-ws

Workaround

If upgrading is not immediately possible, consider implementing input validation on the server side to limit the size of incoming WebSocket payloads. This can help prevent overly long payloads from being processed. For example, you can check the length of the payload before processing it:

const WebSocket = require('ws');
const server = new WebSocket.Server({ port: 8080 });

server.on('connection', (ws) => {
  ws.on('message', (message) => {
    if (message.length > MAX_PAYLOAD_LENGTH) {
      console.error('Payload too long');

  return;

    }
    // Process the message
  });
});

Conclusion

The CVE-2016-10542 vulnerability in the node-ws package poses a significant risk to applications using versions 1.1.0 and earlier. Users are strongly advised to upgrade to a patched version to ensure the security and availability of their applications. Implementing input validation can serve as a temporary measure while preparing for the upgrade.

See every vulnerability recorded for node-ws →

FAQ