{"id":"CVE-2016-10544","aliases":["GHSA-hf5h-hh56-3vrg"],"url":"https://o3.security/vulnerability/CVE-2016-10544","summary":"Denial of Service in uws","details":"Affected versions of `uws` do not properly handle large websocket messages when `permessage-deflate` is enabled, which may result in a denial of service condition.\n\nIf `uws` recieves a 256Mb websocket message when `permessage-deflate` is enabled, the server will compress the message prior to executing the length check, and subsequently extract the message prior to processing. This can result in a situation where an excessively large websocket message passes the length checks, yet still gets cast from a Buffer to a string, which will exceed v8's maximum string size and crash the process.\n\n\n## Recommendation\n\nUpdate to version 0.10.9 or later.\n\nAlternatively, disable `permessage-deflate`.","published":"2018-05-31T20:29:01.643Z","modified":"2026-07-08T12:35:50.871805Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"uws","fixedVersion":"0.10.9"}],"fix":{"url":"https://github.com/uWebSockets/uWebSockets/commit/37deefd01f0875e133ea967122e3a5e421b8fcd9","label":"uWebSockets/uWebSockets@37deefd"},"references":[{"type":"ADVISORY","url":"https://nodesecurity.io/advisories/149"},{"type":"FIX","url":"https://github.com/uWebSockets/uWebSockets/commit/37deefd01f0875e133ea967122e3a5e421b8fcd9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10544"},{"type":"WEB","url":"https://www.npmjs.com/advisories/149"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T12:35:50.871805Z"}}