GMS-2019-145: Denial of Service in ws

June 4, 2019 (updated July 17, 2026)

Affected versions of ws can crash when a specially crafted Sec-WebSocket-Extensions header containing Object.prototype property names as extension or parameter names is sent.

References

github.com/advisories/GHSA-5v72-xg48-5rpm
github.com/websockets/ws/commit/a810bfa44f08c84ff3f43cc71327e9bb5fb273ef
github.com/websockets/ws/commit/c4fe46608acd61fbf7397eadc47378903f95b78a
github.com/websockets/ws/commit/f8fdcd40ac8be7318a6ee41f5ceb7e77c995b407
snyk.io/vuln/npm:ws:20171108

Code Behaviors & Features

Detect and mitigate GMS-2019-145 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →