PT-2018-4723 · Node · Uws

Published 2018-05-31 · Updated 2020-09-01 · CVE-2016-10544

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions uws versions 0.10.0 through 0.10.8

Description The issue arises when a WebSocket server instance with permessage-deflate enabled receives a large WebSocket message. If a 256MB WebSocket message is sent, the compression may shrink it to less than 16MB, allowing it to pass the length check. However, upon inflation, the data can exceed V8's maximum string size, causing the Node process to crash. This can result in a denial of service condition.

Recommendations Update to version 0.10.9 or later. As a temporary workaround, consider disabling the permessage-deflate feature to minimize the risk of exploitation.

Fix

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

CVE-2016-10544

GHSA-HF5H-HH56-3VRG

Affected Products

Uws

References · 6

• https://github.com/uWebSockets/uWebSockets/commit/37deefd01f0875e133ea967122e3a5e421b8fcd9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-10544 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10544 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hf5h-hh56-3vrg · Vendor Advisory
• https://nodesecurity.io/advisories/149 · Note
• https://npmjs.com/advisories/149 · Note