# CVE-2016-10542: ws excessive websocket payload denial of service

Source: https://junglewise.ai/threats/cve-2016-10542-ws-excessive-websocket-payload-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-02-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2016-10542 · Severity: info · CVSS 7.5 · Published 2019-02-18

ws is a popular Node.js WebSocket library used by many real-time communication applications and frameworks like Socket.IO. A remote attacker can crash the Node.js process by sending an excessively large WebSocket payload, causing service unavailability and potential operational disruption.

Technologies: [ws (npm)](https://junglewise.ai/threats/technologies/ws). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2016-10542 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-10542 being exploited in the wild.

**How severe is CVE-2016-10542?** Informational severity, with a CVSS score of 7.5, published 18 February 2019.

**Which products and versions are affected?** ws (npm) SEMVER:introduced=0,fixed=1.1.1.

**Is there a fix for CVE-2016-10542?** Yes. ws (npm): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-10542 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2016-10542?** Check whether you run ws (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ws (npm): upgrade to 1.1.1 or later

  ```sh
  npm install ws@1.1.1
  ```


## Technical details

The vulnerability is a resource exhaustion condition (CWE-400) in the ws library's Receiver component, which does not properly limit the size of incoming WebSocket payloads. When a malicious actor sends a WebSocket message larger than available memory (default limit ~256MB), the library attempts to allocate a massive buffer and crashes the Node.js process with an out-of-memory error. The attack is network-based and requires no authentication or user interaction—a remote unauthenticated attacker can trigger the DoS simply by establishing a WebSocket connection and sending a large payload. The vulnerability affects all versions prior to 1.1.1; patching to version 1.1.1 or later is available, and administrators can also mitigate by setting the maxpayload option to a smaller limit.

## Affected products

- ws ws all versions prior to 1.1.1

## Identifiers

- CVE-2016-10542
- GHSA-6663-c963-2gqg

## Timeline

- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2016: patched: Fixed in version 1.1.1

## References

- [https://github.com/nodejs/node/issues/7388](https://github.com/nodejs/node/issues/7388)

## Related threats

- [websockets ws memory exhaustion DoS via small fragments](https://junglewise.ai/threats/cve-2026-48779-websockets-ws-memory-exhaustion-dos-via-small-fragments)
- [websockets ws uninitialized memory disclosure in websocket.close](https://junglewise.ai/threats/cve-2026-45736-websockets-ws-uninitialized-memory-disclosure-in-websocket-close)
- [ws ReDoS vulnerability in Sec-Websocket-Protocol header parsing](https://junglewise.ai/threats/cve-2021-32640-ws-redos-vulnerability-in-sec-websocket-protocol-header-parsing)
- [ws WebSocket denial of service in Sec-WebSocket-Extensions parsing](https://junglewise.ai/threats/ws-websocket-denial-of-service-in-sec-websocket-extensions-parsing-199b7f5b)
- [websockets ws remote memory disclosure via uninitialized buffers](https://junglewise.ai/threats/cve-2016-10518-websockets-ws-remote-memory-disclosure-via-uninitialized-buffers)