CVE-2020-7662
High
Description
websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.
SeverityHigh
CVSS7.5
Exploit probability—
ProductWebsocket-extensions
PublishedJun 2, 2020
First seenJun 2, 2020
How to fix
Update
- websocket-extensions_project websocket-extensions0.1.4 or later
- websocket-extensions0.1.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| websocket-extensions_project websocket-extensions | v < 0.1.4 | 0.1.4 |
| websocket-extensionsnpm | v < 0.1.4 | 0.1.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.