CVE-2016-10542
DoS due to excessively large websocket message in ws
CVE-2016-10542 is a high vulnerability (CVSS 7.5) in Ws Project Ws, published May 31, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.42%, the 94th percentile. Fixed in ws 1.1.1.
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
- Record
CVE-2016-10542- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400, CWE-20
- Updated
- 2026-11-02
CVE List No score
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
- Record
CVE-2016-10542- Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2019-0237 No score
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
- Record
EUVD-2019-0237- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6663-c963-2gqg No score
DoS due to excessively large websocket message in ws
Affected versions of ws do not appropriately limit the size of incoming websocket payloads, which may result in a denial of service condition when the node process crashes after receiving a large payload.
Recommendation
Update to version 1.1.1 or later.
Alternatively, set the maxpayload option for the ws server to a value smaller than 256MB.
- Record
GHSA-6663-c963-2gqg- Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
- Record
CVE-2016-10542- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-10542
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
- Record
DEBIAN-CVE-2016-10542- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-10542
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
- Record
UBUNTU-CVE-2016-10542- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1784596294 No score
TuxCare security update for ws (1 CVE)
TuxCare rebuilt ws to address 1 CVE. Fixed in 0.8.1-tuxcare.2.
- Record
CLSA-2026-1784596294- Updated
- 2026-11-02
OSVGHSA-6663-c963-2gqg No score
DoS due to excessively large websocket message in ws
Affected versions of ws do not appropriately limit the size of incoming websocket payloads, which may result in a denial of service condition when the node process crashes after receiving a large payload.
Recommendation
Update to version 1.1.1 or later.
Alternatively, set the maxpayload option for the ws server to a value smaller than 256MB.
- Record
GHSA-6663-c963-2gqg- Weakness
- CWE-400
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wsnpm |
before 1.1.1 | 1.1.1 |
wsTuxCare:npm |
0.8.1-tuxcare.0 up to 0.8.1-tuxcare.2, plus listed versions 0.8.10.8.1-tuxcare.1 |
0.8.1-tuxcare.2 |
node-wsDebian:12 |
before 1.1.0+ds1.e6ddaae4-5 | 1.1.0+ds1.e6ddaae4-5 |
node-wsDebian:13 |
before 1.1.0+ds1.e6ddaae4-5 | 1.1.0+ds1.e6ddaae4-5 |
node-wsDebian:14 |
before 1.1.0+ds1.e6ddaae4-5 | 1.1.0+ds1.e6ddaae4-5 |
node-wsUbuntu:16.04:LTS |
All versions, plus listed versions 0.7.2+ds1.349b7460-11.0.1+ds1.e6ddaae4-1 |
None known |
node-wsUbuntu:18.04:LTS |
All versions, plus listed versions 1.1.0+ds1.e6ddaae4-3build11.1.0+ds1.e6ddaae4-3ubuntu1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | ws - Denial of Service |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, Metasploit, NVD, OSV |