Executive brief
ws is a popular Node.js WebSocket library used by many real-time communication applications and frameworks like Socket.IO. A remote attacker can crash the Node.js process by sending an excessively large WebSocket payload, causing service unavailability and potential operational disruption.
Technical details
The vulnerability is a resource exhaustion condition (CWE-400) in the ws library's Receiver component, which does not properly limit the size of incoming WebSocket payloads. When a malicious actor sends a WebSocket message larger than available memory (default limit ~256MB), the library attempts to allocate a massive buffer and crashes the Node.js process with an out-of-memory error. The attack is network-based and requires no authentication or user interaction—a remote unauthenticated attacker can trigger the DoS simply by establishing a WebSocket connection and sending a large payload. The vulnerability affects all versions prior to 1.1.1; patching to version 1.1.1 or later is available, and administrators can also mitigate by setting the maxpayload option to a smaller limit.
Affected products
- ws ws all versions prior to 1.1.1
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2016: patched: Fixed in version 1.1.1