Executive brief
uWebSockets is a popular library for building WebSocket servers. When permessage-deflate compression is enabled, the library fails to properly validate the size of incoming WebSocket messages before decompressing them. An attacker can send a specially crafted compressed message that passes length checks but expands to exceed the V8 JavaScript engine's maximum string size, crashing the server and causing a complete service outage.
Technical details
This vulnerability is a denial of service caused by improper bounds checking on WebSocket message decompression (CWE-400). The vulnerable code compresses incoming messages before validating their size, allowing an attacker to send a 256MB message when permessage-deflate is enabled that passes the length check. When the compressed data is decompressed and cast to a string, it exceeds V8's maximum string size limit, crashing the Node.js process. The attack requires permessage-deflate to be enabled and network access to the WebSocket server. The fix, released in version 0.10.9, limits decompression to approximately 16MB and drops the connection on inflate errors.
Affected products
- uWebSockets uWebSockets 0.10.0 through 0.10.8
Timeline
- 2020-09-01: disclosed
- 2016: patched: Fix released in version 0.10.9