search

max-mapper / websocket-stream

websockets with the node stream API
BSD 2-Clause "Simplified" License
668 stars 114 forks source link

Security Vulnerability: CVE-2024-37890- Security Level: HIGH #165

Open essjayhch opened 2 months ago

essjayhch commented 2 months ago

Reported Security Vulnerability with dependency package "ws" https://www.mend.io/vulnerability-database/CVE-2024-37890

This impacts numerous downstream packages that source this package for websocket behaviours.

A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6)