org.webjars.npm:websocket-driver 0.7.4

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:websocket-driver package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
C Improper Handling of Length Parameter Inconsistency Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency through the `hybi.js` WebSocket frame processing in `lib/websocket/driver`. An attacker can corrupt how the server parses a message by sending a draft WebSocket frame with a length header made of an indefinite run of bytes with the high bit set, causing the parsed length to grow past the configured maximum. As the parser accumulates that oversized length into a JavaScript number, precision is lost and the following payload is decoded incorrectly, breaking message handling on the server and delivering malformed data to the application. How to fix Improper Handling of Length Parameter Inconsistency? Upgrade `org.webjars.npm:websocket-driver` to version 0.7.5 or higher.	[,0.7.5)
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via message compression through the `hybi` message handling in `lib/websocket/driver/hybi.js`. An attacker can make a WebSocket server or client accept oversized messages by sending compressed `permessage-deflate` frames whose post-decompression payload exceeds the configured maximum length. The length check is applied to the frame data before extension processing, so the application enforces the limit on compressed input rather than the expanded message. This can let attacker-supplied messages consume more memory and processing than intended, causing resource exhaustion or other breakage in deployments that rely on the max-message-size setting. Notes Affected deployments are the ones that negotiate `permessage-deflate`; the bypass is in the post-extension message path, so the configured max-length setting is only meaningful for traffic that is actually processed through that extension chain. The issue can affect both servers and clients using the library, since the length check sits in the shared `hybi` message handling path rather than in a server-only code path. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.webjars.npm:websocket-driver` to version 0.7.5 or higher.	[,0.7.5)

Vulnerability

Vulnerable Version

Improper Handling of Length Parameter Inconsistency

Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency through the hybi.js WebSocket frame processing in lib/websocket/driver. An attacker can corrupt how the server parses a message by sending a draft WebSocket frame with a length header made of an indefinite run of bytes with the high bit set, causing the parsed length to grow past the configured maximum. As the parser accumulates that oversized length into a JavaScript number, precision is lost and the following payload is decoded incorrectly, breaking message handling on the server and delivering malformed data to the application.

How to fix Improper Handling of Length Parameter Inconsistency?

Upgrade org.webjars.npm:websocket-driver to version 0.7.5 or higher.

[,0.7.5)

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via message compression through the hybi message handling in lib/websocket/driver/hybi.js. An attacker can make a WebSocket server or client accept oversized messages by sending compressed permessage-deflate frames whose post-decompression payload exceeds the configured maximum length. The length check is applied to the frame data before extension processing, so the application enforces the limit on compressed input rather than the expanded message. This can let attacker-supplied messages consume more memory and processing than intended, causing resource exhaustion or other breakage in deployments that rely on the max-message-size setting.

Notes

Affected deployments are the ones that negotiate permessage-deflate; the bypass is in the post-extension message path, so the configured max-length setting is only meaningful for traffic that is actually processed through that extension chain.
The issue can affect both servers and clients using the library, since the length check sits in the shared hybi message handling path rather than in a server-only code path.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.webjars.npm:websocket-driver to version 0.7.5 or higher.

[,0.7.5)

org.webjars.npm:websocket-driver@0.7.4

latest version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically