Affected versions of ws do not appropriately limit the size of incoming websocket payloads, which may result in a denial of service condition when the node process crashes after receiving a large payload.

Recommendation

Update to version 1.1.1 or later.
Alternatively, set the maxpayload option for the ws server to a value smaller than 256MB.

References

• https://nvd.nist.gov/vuln/detail/CVE-2016-10542
• nodejs/node#7388
• GHSA-6663-c963-2gqg
• https://www.npmjs.com/advisories/120