fastify/websocket vulnerable to uncaught exception via crash on malformed packet

Description

Any application using @fastify/websocket could crash if a specific, malformed packet is sent.

All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 4.3.0

References

• GHSA-4pcg-wr6c-h9cq
• CVE-2022-39386
• CWE-248
• CAPEC-310
• OWASP 2021-A6

Related Issues

• JOSE vulnerable to resource exhaustion via specifically crafted JWE - CVE-2022-36083
• React Editable Json Tree vulnerable to arbitrary code execution via function parsing - CVE-2022-36010
• JOSE vulnerable to resource exhaustion via specifically crafted JWE - jose-node-esm-runtime - CVE-2022-36083
• JOSE vulnerable to resource exhaustion via specifically crafted JWE - jose-node-cjs-runtime - CVE-2022-36083

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

fastify-websocket