Skip to content
Fencer Vulns
high 7.5

CVE-2016-10518 json

Remote Memory Disclosure in ws

published 2018-05-31 8 y ago modified 2026-06-17 4 mo ago also GHSA-2mhh-w6q8-5hxw , EUVD-2019-0201

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 80%
public exploits
0
none known

Summary

A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.

Patch / fix

  • npm ws 1.0.1
  • ws_project ws 1.0.1
  • node-ws Debian 14, Debian 13, Debian 12 1.0.1+ds1.e6ddaae4-1

debian advisories DEBIAN-CVE-2016-10518

  • node-ws Ubuntu 16.04 LTS 1.0.1+ds1.e6ddaae4-1

ubuntu advisories UBUNTU-CVE-2016-10518

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Exploit prediction

1.98% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected packages

ecosystem package affected fixed in
npm ws
<1.0.1
1.0.1

Affected products

  • HackerOne ws node module

Classification

Weakness
  • CWE-201 Insertion of Sensitive Information Into Sent Data
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.