-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ws | npm | >= 2.1.0, < 5.2.4 | 5.2.4 |
| ws | npm | >= 6.0.0, < 6.2.3 | 6.2.3 |
| ws | npm | >= 7.0.0, < 7.5.10 | 7.5.10 |
| ws | npm | >= 8.0.0, < 8.17.1 | 8.17.1 |
Miggo AIRoot Cause AnalysisThe vulnerability occurs because the code attempts to access properties (like .toLowerCase()) of header values (specifically Upgrade and Sec-WebSocket-Key) without first checking if these headers exist in the req.headers (for server) or res.headers (for client) object. Node.js's HTTP parser may omit headers from this object if the maxHeadersCount limit is exceeded. The patches consistently add checks for undefined before accessing these properties. The primary vulnerable function, as per the advisory and PoC, is WebSocketServer.handleUpgrade which processes incoming requests on the server. The initAsClient function in lib/websocket.js was also patched for an analogous issue on the client side when processing response headers. Both functions are directly involved in parsing headers critical for WebSocket establishment and were modified to prevent crashes when these headers are missing due to header count limits.
Ongoing coverage of React2Shell