Ws Project Ws vulnerabilities

CVE-2024-37890 [HIGH] CWE-476 ws affected by a DoS when handling a request with many HTTP headers ws affected by a DoS when handling a request with many HTTP headers ### Impact A request with a number of headers exceeding the[`server.maxHeadersCount`][] threshold could be used to crash a ws server. ### Proof of concept ```js const http = require('http'); const WebSocket = require('ws'); const wss = new WebSocket.Server({ port: 0 }, function () { const chars = "!#$%&'*+-.0123456789abcdefghij

CVE-2020-35896 [HIGH] CWE-400 Insufficient size checks in ws Insufficient size checks in ws An issue was discovered in the ws crate through 2020-09-25 for Rust. The outgoing buffer is not properly limited, leading to a remote memory-consumption attack.

CVE-2021-32640 [MEDIUM] CWE-400 CVE-2021-32640: ws is an open source WebSocket client and server library for Node.js. A specially crafted value of t ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in [email protected] (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the i

CVE-2016-10518 [HIGH] CWE-201 CVE-2016-10518: A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clie A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need t

CVE-2016-10542 [HIGH] CWE-400 CVE-2016-10542: ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.