CVE-2016-10542: Input Validation
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2016-10542.
What is the severity of CVE-2016-10542?
The severity of CVE-2016-10542 is high with a score of 7.5.
Which software versions are affected by CVE-2016-10542?
The software version affected by CVE-2016-10542 is ws 1.1.0 and earlier.
How can CVE-2016-10542 be exploited?
CVE-2016-10542 can be exploited by sending an overly long WebSocket payload to a ws server, causing the node process to crash.
Are there any references for CVE-2016-10542?
Yes, you can find references for CVE-2016-10542 at the following links: 1. https://github.com/nodejs/node/issues/7388 2. https://nodesecurity.io/advisories/120