Junglewise Threat Intelligence

CVE-2022-39386: @fastify/websocket denial of service via malformed WebSocket packet

CVE-2022-39386 · Severity: low · CVSS 3.1 · Published 2022-11-07

Vendors: Fastify.

Executive brief

@fastify/websocket is a popular WebSocket support library for the Fastify web framework. A vulnerability in the library causes the application to crash when processing certain malformed WebSocket packets (such as those with invalid control bits), resulting in a denial-of-service condition. Attackers with network access can send a single crafted packet to crash the entire server and interrupt service for all users.

Technical details

This is an uncaught exception vulnerability (CWE-248) in the WebSocket packet parsing logic. When the underlying 'ws' library encounters certain malformed WebSocket frames—specifically packets with RSV2 and RSV3 bits set without negotiation—it throws a RangeError that is not caught by @fastify/websocket. The error propagates uncaught, causing a Node.js process crash. The vulnerability is triggered by sending a malformed packet over the network to an application using @fastify/websocket; no authentication or user interaction is required. The attack vector is network-based with no complexity requirement. The fix adds an error handler to gracefully catch and handle these exceptions. Patches are available in @fastify/websocket v5.0.1 (for fastify v3) and v7.1.1 (for fastify v4). The deprecated fastify-websocket module is not being patched.

Affected products

  • fastify @fastify/websocket 5.0.0 to <5.0.1, >=6.0.0 to <7.1.1
  • fastify-websocket all versions through 4.3.0 (deprecated, unpatched)

Timeline

  • 2022-11-07: disclosed: Advisory GHSA-4pcg-wr6c-h9cq published
  • 2022-11-04: patched: Fixed in @fastify/websocket v5.0.1 and v7.1.1

References