CVE-2016-10518
A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a…
- Published
- Updated
- Reserved
- Assigned by
- hackerone
Description
A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | High7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 2.0% · top 19% of all CVEs (4 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
Affected products
- affected <= 1.0.0
Affected packages
From reviewed advisories of the GitHub Advisory Database.
References (3)
- https://github.com/websockets/ws/releases/tag/1.0.1 (opens in a new tab)x_refsource_MISCx_transferred
- https://nodesecurity.io/advisories/67 (opens in a new tab)x_refsource_MISCx_transferred
- https://gist.github.com/c0nrad/e92005446c480707a74a (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-2mhh-w6q8-5hxw (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2016-10518)Record last updated .