CVE-2016-10542

HIGH

WS < 1.1.0 - Denial of Service

Title source: rule

Description

ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.

Exploits (1)

metasploit WORKING POC
by Ryan Knell, Sonatype Security Research, Nick Starke, Sonatype Security Research · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/ws_dos.rb

References (2)

Scores

CVSS v3 7.5
EPSS 0.6607
EPSS Percentile 98.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-20 CWE-400
Status published
Products (2)
npm/ws 0 - 1.1.1npm
ws_project/ws < 1.1.0
Published May 31, 2018
Tracked Since Feb 18, 2026