Memory corruption in HackerOne ws node module
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-201.
Summary
A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HackerOne | ws node module | up to 1.0.0 | — | No fix listed | CNA |
| — | ws (npm) | before 1.0.1 | 1.0.1 | Patch available | GHSA-2mhh-w6q8-5hxw |
- ws node module VendorHackerOne Affected up to 1.0.0 Fixed in — No fix listed CNA
- ws (npm) Vendor— Affected before 1.0.1 Fixed in 1.0.1 Patch available GHSA-2mhh-w6q8-5hxw
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ws_project:ws:*:*:*:*:*:node.js:*:* | before 1.0.1 | Vulnerable | websockets |
- cpe:2.3:a:ws_project:ws:*:*:*:*:*:node.js:*:* Versions before 1.0.1 Vulnerable ·websockets
Remediation
- Fix · GHSA-2mhh-w6q8-5hxw ws (npm) Fixed in 1.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2016-10518
- 2026-10-03 Alias added: GHSA-2mhh-w6q8-5hxw
References
Advisory 4
More websockets Ws vulnerabilities
- TI-2026-36049 ws: Memory exhaustion DoS from tiny fragments and data chunks CVSS 3.1HIGH 7.5
- TI-2026-33473 ws: Uninitialized memory disclosure CVSS 3.1HIGH 7.5
- TI-2016-08584 Uncontrolled resource consumption in HackerOne ws node module CVSS 3.0HIGH 7.5
- TI-2021-12308 ReDoS in Sec-Websocket-Protocol header CVSS 3.1MEDIUM 5.3
Sources
- CVE-2016-10518 · CVE Program
- CVE-2016-10518 · NVD
- FIRST EPSS
- GHSA-2mhh-w6q8-5hxw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences