Skip to content

Denial of Service in nes

High severity GitHub Reviewed Published Jul 24, 2018 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

npm nes (npm)

Affected versions

<= 6.4.0

Patched versions

6.4.1

Description

Affected versions of nes are vulnerable to denial of service when given an invalid cookie header, and websocket authentication is set to cookie. Submitting an invalid cookie on the websocket upgrade request will cause the node process to throw and exit.

Recommendation

Update to version 6.4.1 or later.

References

Published to the GitHub Advisory Database Jul 24, 2018
Reviewed Jun 16, 2020
Last updated Jan 9, 2023

Severity

High

EPSS score

0.202%
(58th percentile)

Weaknesses

CVE ID

CVE-2017-16025

GHSA ID

GHSA-3pwh-5mmc-mwrx

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.