Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

uws

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratednpmAmendedPublished

    Denial of Service in uws

    CVE-2016-10544 · GHSA-hf5h-hh56-3vrg

    Affected
    • npm uws >= 0.10.0, <= 0.10.8
    Fixed in
    0.10.9· Vendor fix available
    Issue
    Affected versions of uws do not properly handle large websocket messages when permessage-deflate is enabled, which may result in a denial of service condition. If uws recieves a 256Mb websocket message when permessage-deflate is enabled, the server will compress the message prior to executing the length check, and subsequently extract the message prior to processing. This can result in a situation where an excessively large websocket message passes the length checks, yet still gets cast from a Buffer to a string, which will exceed v8's maximum string size and crash the process. Recommendation Update to version 0.10.9 or later. Alternatively, disable permessage-deflate.

    Recommended action: Upgrade to 0.10.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →