Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 4 June 2019.

Which products and versions are affected?

ws (npm) SEMVER:introduced=0.6.0,fixed=1.1.5.

Is there a fix for This vulnerability?

Yes. ws (npm): upgrade to 1.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run ws (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

ws WebSocket denial of service in Sec-WebSocket-Extensions parsing

Severity: low · CVSS 3.1 · Published 2019-06-04

The ws library is a widely-used Node.js WebSocket implementation. An attacker can crash a ws server by sending a malformed Sec-WebSocket-Extensions header containing prototype property names (like "constructor"), causing an unhandled exception. This can be exploited to deny service to legitimate users with a single crafted connection.

Technologies: ws (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 4 June 2019.
Which products and versions are affected?: ws (npm) SEMVER:introduced=0.6.0,fixed=1.1.5.
Is there a fix for This vulnerability?: Yes. ws (npm): upgrade to 1.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run ws (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ws (npm): upgrade to 1.1.5 or later
```
npm install ws@1.1.5
```

Technical details

The vulnerability exists in ws's parsing of the Sec-WebSocket-Extensions HTTP header during WebSocket handshake. The parser fails to filter out Object.prototype property names (such as "constructor", "hasOwnProperty", etc.) when extracting extension or parameter names from the header. When these reserved names are used, they can pollute the object prototype or trigger unexpected behavior, causing the server to crash with an unhandled exception. The attack requires only network access—no authentication—and can be triggered with a single malicious WebSocket upgrade request. Versions 0.6.0–1.1.4 and 2.0.0–3.3.0 are affected. The fix (committed in the referenced commits) adds explicit filtering to ignore prototype property names during header parsing. Patches are available in ws 1.1.5 and 3.3.1 or later.

Affected products

websockets ws 0.6.0 through 1.1.4, 2.0.0 through 3.3.0

Timeline

2019-06-04: disclosed
2019-06-04: patched: Fix applied in commits c4fe466 and f8fdcd4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.