GMS-2019-145: Denial of Service in ws

June 4, 2019 (updated July 17, 2026)

Affected versions of ws can crash when a specially crafted Sec-WebSocket-Extensions header containing Object.prototype property names as extension or parameter names is sent.

References

github.com/advisories/GHSA-5v72-xg48-5rpm
github.com/websockets/ws/commit/a810bfa44f08c84ff3f43cc71327e9bb5fb273ef
github.com/websockets/ws/commit/c4fe46608acd61fbf7397eadc47378903f95b78a
github.com/websockets/ws/commit/f8fdcd40ac8be7318a6ee41f5ceb7e77c995b407
snyk.io/vuln/npm:ws:20171108

Code Behaviors & Features

Detect and mitigate GMS-2019-145 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →