Improper Handling of Length Parameter Inconsistencywebsocket-driver is a websocket protocol handler with pluggable I/O.
Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency through the hybi.js WebSocket frame processing in lib/websocket/driver. An attacker can corrupt how the server parses a message by sending a draft WebSocket frame with a length header made of an indefinite run of bytes with the high bit set, causing the parsed length to grow past the configured maximum. As the parser accumulates that oversized length into a JavaScript number, precision is lost and the following payload is decoded incorrectly, breaking message handling on the server and delivering malformed data to the application.
How to fix Improper Handling of Length Parameter Inconsistency? Upgrade websocket-driver to version 0.7.5 or higher.
| |
Allocation of Resources Without Limits or Throttlingwebsocket-driver is a websocket protocol handler with pluggable I/O.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via message compression through the hybi message handling in lib/websocket/driver/hybi.js. An attacker can make a WebSocket server or client accept oversized messages by sending compressed permessage-deflate frames whose post-decompression payload exceeds the configured maximum length. The length check is applied to the frame data before extension processing, so the application enforces the limit on compressed input rather than the expanded message. This can let attacker-supplied messages consume more memory and processing than intended, causing resource exhaustion or other breakage in deployments that rely on the max-message-size setting.
Notes
- Affected deployments are the ones that negotiate
permessage-deflate; the bypass is in the post-extension message path, so the configured max-length setting is only meaningful for traffic that is actually processed through that extension chain.
- The issue can affect both servers and clients using the library, since the length check sits in the shared
hybi message handling path rather than in a server-only code path.
How to fix Allocation of Resources Without Limits or Throttling? Upgrade websocket-driver to version 0.7.5 or higher.
| |
Denial of Service (DoS)websocket-driver is WebSocket protocol handler with pluggable I/O.
Affected versions of this package are vulnerable to Denial of Service (DoS) attacks.
The Buffer length is immediately allocated after reading the frame, up to a length that is no more that MAX_LENGTH, which is 2^53 - 1 (the largest precisely representable JS integer), and rejects larger frames with a 1009 error before creating the new Buffer.
But Node buffers have a max length of 1GB (0x3fffffff).
Parsing an incoming frame with length between 1GB and MAX_LENGTH, the parser will throw (and perhaps crash your whole server). Attackers can use this to their advantage and cause a Denial of Service on the servers.
How to fix Denial of Service (DoS)? Upgrade websocket-driver to version 0.3.1 or higher.
| |
