What’s Vulnerable › Vulnerabilities

CVE-2016-10544

• Severity: medium (CVSS 5.9 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-05-31 · updated 2026-06-17
• Weakness: CWE-400

Description

uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used compression will shrink said 256mb down to less than 16mb of websocket payload which passes the length check of 16mb payload. This data will then inflate up to 256mb and crash the node process by exceeding V8's maximum string size. This affects uws >=0.10.0 <=0.10.8.

Affected products

• HackerOne uws node module: from 0.10.0 through 0.10.8

References

• https://github.com/uWebSockets/uWebSockets/commit/37deefd01f0875e133ea967122e3a5e421b8fcd9
• https://nodesecurity.io/advisories/149
• https://github.com/uWebSockets/uWebSockets/commit/37deefd01f0875e133ea967122e3a5e421b8fcd9
• https://nodesecurity.io/advisories/149

Get alerted when CVE-2016-10544 or the next vulnerability affects your stack