org.webjars.npm:ws@7.5.13

latest version

8.21.3

latest non vulnerable version

8.21.3

first published

10 years ago

latest version published

12 days ago

licenses detected

MIT
[0.5.0,)

package registry

View on Maven Central Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:ws package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
H Asymmetric Resource Consumption (Amplification) org.webjars.npm:ws is a simple to use websocket client, server and console for node.js. Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) when handling a large number of very small fragments and data chunks. An attacker can cause excessive memory allocation and OOM by sending a high volume of tiny WebSocket frames How to fix Asymmetric Resource Consumption (Amplification)? Upgrade `org.webjars.npm:ws` to version 8.21.2 or higher.	[,8.21.2)
M Use of Uninitialized Resource org.webjars.npm:ws is a simple to use websocket client, server and console for node.js. Affected versions of this package are vulnerable to Use of Uninitialized Resource in the `websocket.close()` implementation in the `Sender` class, which exposes uninitialized memory when a `TypedArray` is provided as the `reason` argument. Note: The project maintainers note that this "flaw is only exploitable through misuse that is unlikely in practice". How to fix Use of Uninitialized Resource? Upgrade `org.webjars.npm:ws` to version 8.21.2 or higher.	[,8.21.2)

Asymmetric Resource Consumption (Amplification)

org.webjars.npm:ws is a simple to use websocket client, server and console for node.js.

Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) when handling a large number of very small fragments and data chunks. An attacker can cause excessive memory allocation and OOM by sending a high volume of tiny WebSocket frames

How to fix Asymmetric Resource Consumption (Amplification)?

Upgrade org.webjars.npm:ws to version 8.21.2 or higher.

[,8.21.2)

Use of Uninitialized Resource

org.webjars.npm:ws is a simple to use websocket client, server and console for node.js.

Affected versions of this package are vulnerable to Use of Uninitialized Resource in the websocket.close() implementation in the Sender class, which exposes uninitialized memory when a TypedArray is provided as the reason argument.

Note: The project maintainers note that this "flaw is only exploitable through misuse that is unlikely in practice".

How to fix Use of Uninitialized Resource?

Upgrade org.webjars.npm:ws to version 8.21.2 or higher.

[,8.21.2)

Go back to all versions of this package