Quick answers
- Is CVE-2016-10542 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2016-10542 being exploited in the wild.
- How severe is CVE-2016-10542?
- Informational severity, with a CVSS score of 7.5, published 18 February 2019.
- Which products and versions are affected?
- ws (npm) SEMVER:introduced=0,fixed=1.1.1.
- Is there a fix for CVE-2016-10542?
- Yes. ws (npm): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2016-10542 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2016-10542?
- Check whether you run ws (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- ws (npm): upgrade to 1.1.1 or later
npm install ws@1.1.1
Technical details
The vulnerability is a resource exhaustion condition (CWE-400) in the ws library's Receiver component, which does not properly limit the size of incoming WebSocket payloads. When a malicious actor sends a WebSocket message larger than available memory (default limit ~256MB), the library attempts to allocate a massive buffer and crashes the Node.js process with an out-of-memory error. The attack is network-based and requires no authentication or user interaction—a remote unauthenticated attacker can trigger the DoS simply by establishing a WebSocket connection and sending a large payload. The vulnerability affects all versions prior to 1.1.1; patching to version 1.1.1 or later is available, and administrators can also mitigate by setting the maxpayload option to a smaller limit.
Affected products
- ws ws all versions prior to 1.1.1
Identifiers
- CVE-2016-10542
- GHSA-6663-c963-2gqg
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2016: patched: Fixed in version 1.1.1