Allocation of Resources Without Limits or Throttling Affecting websocket-driver package, versions <0.7.5

websocket-driver is a websocket protocol handler with pluggable I/O.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via message compression through the hybi message handling in lib/websocket/driver/hybi.js. An attacker can make a WebSocket server or client accept oversized messages by sending compressed permessage-deflate frames whose post-decompression payload exceeds the configured maximum length. The length check is applied to the frame data before extension processing, so the application enforces the limit on compressed input rather than the expanded message. This can let attacker-supplied messages consume more memory and processing than intended, causing resource exhaustion or other breakage in deployments that rely on the max-message-size setting.

Notes

• Affected deployments are the ones that negotiate permessage-deflate; the bypass is in the post-extension message path, so the configured max-length setting is only meaningful for traffic that is actually processed through that extension chain.
• The issue can affect both servers and clients using the library, since the length check sits in the shared hybi message handling path rather than in a server-only code path.

• GitHub Commit 0.7.5
• Maintainer's Advisory