Skip to content

Denial of Service in nes

High severity GitHub Reviewed Published Jul 24, 2018 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

npm nes (npm)

Affected versions

<= 6.4.0

Patched versions

6.4.1

Description

Affected versions of nes are vulnerable to denial of service when given an invalid cookie header, and websocket authentication is set to cookie. Submitting an invalid cookie on the websocket upgrade request will cause the node process to throw and exit.

Recommendation

Update to version 6.4.1 or later.

References

Published to the GitHub Advisory Database Jul 24, 2018
Reviewed Jun 16, 2020
Last updated Jan 9, 2023

Severity

High

EPSS score

Exploit Prediction Scoring System (EPSS)

This score estimates the probability of this vulnerability being exploited within the next 30 days. Data provided by FIRST.
(58th percentile)

Weaknesses

CVE ID

CVE-2017-16025

GHSA ID

GHSA-3pwh-5mmc-mwrx

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.