Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the websocket-driver library, specifically in the parsing of WebSocket frames for draft-75/76 of the protocol. The root cause is the improper handling of the message length header. An attacker can send a stream of bytes that are interpreted as a multi-byte length, causing the server to calculate an extremely large number for the message length. Due to the way JavaScript handles large numbers (64-bit floating-point), this number can lose precision, leading to a discrepancy between the calculated length and the actual payload length. This results in the server incorrectly parsing the WebSocket message, leading to message corruption.
The primary vulnerable function is Draft75.parse in lib/websocket/driver/draft75.js. The patch applied in commit 5b197ca874dab58e96cacad8a3c256797d804680 directly addresses this by adding a check to ensure the calculated length does not exceed a pre-configured maximum length (this._maxLength).
A secondary hardening patch was applied in Hybi._emitMessage in lib/websocket/driver/hybi.js (commit c55679a5b18251dd0a55d18a0cc6a4fd8822b92f). This change adds a check on the payload length after extensions have processed the message, providing an additional layer of protection against excessively large messages for the Hybi protocol version as well.
Draft75.parselib/websocket/driver/draft75.js
Hybi._emitMessagelib/websocket/driver/hybi.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| websocket-driver | npm | < 0.7.5 | 0.7.5 |