GHSA-hf5h-hh56-3vrg

Suggest an improvement
Source
https://github.com/advisories/GHSA-hf5h-hh56-3vrg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-hf5h-hh56-3vrg/GHSA-hf5h-hh56-3vrg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-hf5h-hh56-3vrg
Aliases
Published
2020-09-01T16:02:29Z
Modified
2023-11-08T03:58:11.701417Z
Summary
Denial of Service in uws
Details

Affected versions of uws do not properly handle large websocket messages when permessage-deflate is enabled, which may result in a denial of service condition.

If uws recieves a 256Mb websocket message when permessage-deflate is enabled, the server will compress the message prior to executing the length check, and subsequently extract the message prior to processing. This can result in a situation where an excessively large websocket message passes the length checks, yet still gets cast from a Buffer to a string, which will exceed v8's maximum string size and crash the process.

Recommendation

Update to version 0.10.9 or later.

Alternatively, disable permessage-deflate.

Database specific 
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-400"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:12:32Z"
}
References

Affected packages

npm / uws

Package

Name
uws
View open source insights on deps.dev
Purl
pkg:npm/uws

Affected ranges

Type
SEMVER
Events
Introduced
0.10.0
Fixed
0.10.9

Database specific 

{
    "last_known_affected_version_range": "<= 0.10.8"
}