-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @fastify/websocket | npm | >= 6.0.0, < 7.1.1 | 7.1.1 |
| fastify-websocket | npm | <= 4.3.0 | |
| @fastify/websocket | npm | >= 5.0.0, < 5.0.1 | 5.0.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from unhandled 'error' events on the WebSocket connection stream. The patch added an error handler (connection.on('error', ...)) to log errors, preventing uncaught exceptions. The pre-patch code in index.js created the connection without this critical error handling, making the WebSocket connection setup logic the vulnerable component. The test case demonstrates triggering a WS_ERR_UNEXPECTED_RSV_2_3 error via malformed packets, which would crash the process without the handler.