Denial of Service in uws

Also known as GHSA-hf5h-hh56-3vrg

Published 8 y ago 2018-05-31 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.9

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.3%

percentile 71%

Public exploits

none known

uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used compression will shrink said 256mb down to less than 16mb of websocket payload which passes the length check of 16mb payload. This data will then inflate up to 256mb and crash the node process by exceeding V8's maximum string size. This affects uws >=0.10.0 <=0.10.8.

Exploit prediction (EPSS)

1.32% probability of exploitation in the next 30 days, higher than 71% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	5.9	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:N/A:P`

Affected packages

Ecosystem	Package	Affected	Fixed in
npm	`uws`	>=0.10.0, <0.10.9	0.10.9

Affected products

HackerOne uws node module

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption
CWE-20 Improper Input Validation

References

github.com /uWebSockets/uWebSockets/commit/37deefd01f0875e133ea967122e3a5e421b8fcd9 · x_refsource_MISC, x_transferred
nodesecurity.io /advisories/149 · x_refsource_MISC, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-10544 · advisory
npmjs.com /advisories/149 · web

Sources

CVE List: CVE-2016-10544
GitHub Advisory: GHSA-hf5h-hh56-3vrg
NVD: CVE-2016-10544

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary