CVE-2016-10518: A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. Th...

Description

A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.

Metrics

EPSS Probability

2.02%

78.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Ws Project	Ws	< 1.0.1

References

https://gist.github.com/c0nrad/e92005446c480707a74aPatch, Third Party Advisory
https://github.com/websockets/ws/releases/tag/1.0.1Release Notes, Third Party Advisory
https://nodesecurity.io/advisories/67Third Party Advisory
https://gist.github.com/c0nrad/e92005446c480707a74aPatch, Third Party Advisory
https://github.com/websockets/ws/releases/tag/1.0.1Release Notes, Third Party Advisory
https://nodesecurity.io/advisories/67Third Party Advisory

Timeline

Published: May 31, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2016-10518?

A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.

How severe is CVE-2016-10518?

Severity scoring for CVE-2016-10518 is pending analysis. The EPSS model estimates a 2.02% probability of exploitation in the next 30 days.

How do I fix CVE-2016-10518?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2016

View all 2016CVEs →