Security vulnerability in ws (WebSocket) package

[jtorreggiani]

Issue description

There seems to be a security vulnerability in the ws package. The issue was discovered while running the Node Security Platform CLI utility as part of a continuous integration build.

yarn run v1.3.2
$ ./node_modules/.bin/nsp check
(+) 1 vulnerabilities found
┌───────────────┬───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│               │ Denial of Service                                                                                                                                                                 │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Name          │ ws                                                                                                                                                                                │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ CVSS          │ 7.5 (High)                                                                                                                                                                        │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Installed     │ 2.3.1                                                                                                                                                                             │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Vulnerable    │ <3.3.1                                                                                                                                                                            │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Patched       │ >= 3.3.1                                                                                                                                                                          │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Path          │ connect-js@1.0.0 > webpack-bundle-analyzer@2.9.0 > ws@2.3.1                                                                                                                       │
├───────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ More Info     │ https://nodesecurity.io/advisories/550                                                                                                                                            │
└───────────────┴───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘

Technical info

• Webpack Bundle Analyzer version: 2.3.1
• Webpack version: 1.14.0
• Node.js version: 8.9.1
• npm/yarn version: 1.3.2
• OS: macOS Sierra / Ubuntu

Debug info

How do you use this module? As CLI utility or as plugin?
CLI utility

If CLI, what command was used? (e.g. webpack-bundle-analyzer -O path/to/stats.json)

If plugin, what options were provided? (e.g. new BundleAnalyzerPlugin({ analyzerMode: 'disabled', generateStatsFile: true }))

What other Webpack plugins were used?
None.

It would be nice to also attach webpack stats file.
It can be generated using these options:

new BundleAnalyzerPlugin({
  analyzerMode: 'disabled',
  generateStatsFile: true,
  // Excludes module sources from stats file so there won't be any sensitive data
  statsOptions: { source: false }
})`

stats.json will be created in Webpack bundle output directory.

[valscion]

Thank you for reporting this issue!

If I looked at the vulnerability correctly, it was about there being a Denial-of-Service bug in ws. As webpack-bundle-analyzer is a development-only tool, this isn't as severe as it could be.

Nevertheless, I'll push an update out.

[valscion]

Fix for this has been published in v2.9.1

[jtorreggiani]

Thanks!