Executive brief
SockJS-Node is a popular Node.js library that provides real-time bidirectional communication via WebSockets and fallback mechanisms. A flaw in how the library validates the WebSocket upgrade header can cause the application or container hosting a SockJS-enabled service to crash, resulting in service unavailability and potential operational disruption.
Technical details
The vulnerability exists in SockJS-Node's handling of the HTTP Upgrade header during WebSocket upgrade negotiation. When a malformed or unexpected "websocket" value is provided in the Upgrade header, the library fails to validate it correctly, leading to an ERR_STREAM_WRITE_AFTER_END error that crashes the application. This is a denial-of-service vulnerability (CWE-20: Improper Input Validation) that requires only network connectivity and no authentication. An unauthenticated attacker can send a crafted HTTP request with a malicious Upgrade header to trigger the crash. The issue is fixed in SockJS version 0.3.20 and later.
Affected products
- SockJS SockJS-Node before 0.3.20
Timeline
- 2020-07-09: disclosed: Vulnerability disclosed via NVD
- 2021-04-06: patched: Fix available in version 0.3.20