Loading HuntDB...

GHSA-hf5h-hh56-3vrg

GitHub Security Advisory

Denial of Service in uws

✓ GitHub Reviewed HIGH Has CVE

Advisory Details

Affected versions of `uws` do not properly handle large websocket messages when `permessage-deflate` is enabled, which may result in a denial of service condition.

If `uws` recieves a 256Mb websocket message when `permessage-deflate` is enabled, the server will compress the message prior to executing the length check, and subsequently extract the message prior to processing. This can result in a situation where an excessively large websocket message passes the length checks, yet still gets cast from a Buffer to a string, which will exceed v8's maximum string size and crash the process.

## Recommendation

Update to version 0.10.9 or later.

Alternatively, disable `permessage-deflate`.

Affected Packages

npm uws
Affected versions: 0.10.0 (fixed in 0.10.9)

Related CVEs

Key Information

GHSA ID
GHSA-hf5h-hh56-3vrg
Published
September 1, 2020 4:02 PM
Last Modified
August 31, 2020 6:12 PM
CVSS Score
7.5 /10
Primary Ecosystem
npm
Primary Package
uws
GitHub Reviewed
✓ Yes

Dataset

Last updated: July 3, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.