Hackerone Ws Node Module vulnerabilities

CVE-2016-10518 [HIGH] CWE-201 CVE-2016-10518: A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clie A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need t

CVE-2016-10542 [HIGH] CWE-400 CVE-2016-10542: ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.