CVE-2016-10542

Name	CVE-2016-10542
Description	ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	927671

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-ws (PTS)	bullseye	7.4.2+~cs18.0.8-2	fixed
	bookworm	8.11.0+~cs13.7.3-1	fixed
	forky, sid, trixie	8.18.1+~cs14.18.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
node-ws	source	jessie	(unfixed)	end-of-life
node-ws	source	stretch	1.1.0+ds1.e6ddaae4-3+deb9u1
node-ws	source	(unstable)	1.1.0+ds1.e6ddaae4-5		927671

Notes

[jessie] - node-ws <end-of-life> (Nodejs in jessie not covered by security support)
https://nodesecurity.io/advisories/120
https://github.com/nodejs/node/issues/7388