What’s Vulnerable › Vulnerabilities

CVE-2020-7662: Regular Expression Denial of Service in websocket-extensions (NPM package)

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-06-02 · updated 2026-06-17

Description

websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.

Affected products

• websocket-extensions (npm): before 0.1.4 — fixed in 0.1.4
• Npm Websocket-Extensions: before 0.1.4 — fixed in 0.1.4

How to fix

Upgrade to a fixed version: websocket-extensions (npm) 0.1.4; Npm Websocket-Extensions 0.1.4. Check the vendor advisory for mitigations.

References

• https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions
• https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237
• https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv
• https://snyk.io/vuln/SNYK-JS-WEBSOCKETEXTENSIONS-570623
• https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions
• https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237
• https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv
• https://snyk.io/vuln/SNYK-JS-WEBSOCKETEXTENSIONS-570623

Get alerted when CVE-2020-7662 or the next vulnerability affects your stack