Executive brief
The ws library is a widely-used Node.js WebSocket implementation. An attacker can crash a ws server by sending a malformed Sec-WebSocket-Extensions header containing prototype property names (like "constructor"), causing an unhandled exception. This can be exploited to deny service to legitimate users with a single crafted connection.
Technical details
The vulnerability exists in ws's parsing of the Sec-WebSocket-Extensions HTTP header during WebSocket handshake. The parser fails to filter out Object.prototype property names (such as "constructor", "hasOwnProperty", etc.) when extracting extension or parameter names from the header. When these reserved names are used, they can pollute the object prototype or trigger unexpected behavior, causing the server to crash with an unhandled exception. The attack requires only network access—no authentication—and can be triggered with a single malicious WebSocket upgrade request. Versions 0.6.0–1.1.4 and 2.0.0–3.3.0 are affected. The fix (committed in the referenced commits) adds explicit filtering to ignore prototype property names during header parsing. Patches are available in ws 1.1.5 and 3.3.1 or later.
Affected products
- websockets ws 0.6.0 through 1.1.4, 2.0.0 through 3.3.0
Timeline
- 2019-06-04: disclosed
- 2019-06-04: patched: Fix applied in commits c4fe466 and f8fdcd4
References
- https://github.com/websockets/ws/commit/a810bfa44f08c84ff3f43cc71327e9bb5fb273ef
- https://github.com/websockets/ws/commit/c4fe46608acd61fbf7397eadc47378903f95b78a
- https://github.com/websockets/ws/commit/f8fdcd40ac8be7318a6ee41f5ceb7e77c995b407
- https://github.com/websockets/ws
- https://snyk.io/vuln/npm:ws:20171108