Description
websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | websocket-extensions (npm) | All versions prior to 0.1.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 1 | servicemesh-grafana +1 | 6.2.2-38.el8 | RHSA-2020:2861, RHSA-2020:2796 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | js-jquery | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | websocket-extensions | < 0.1.4 | 0.1.4 | GHSA-g78m-2chm-r7qv |
Advisories 5
- WID-SEC-2026-4026 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- RHSA-2020:2861 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-grafana security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:2796 Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-grafana security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2023-1350 Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern BSI CERT-Bund (WID) · Jul 1, 2026
- WID-SEC-2026-0777 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 18, 2026
References
- https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions
- https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv
- https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237
- https://snyk.io/vuln/SNYK-JS-WEBSOCKETEXTENSIONS-570623