{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-30T21:48:34.506","vulnerabilities":[{"cve":{"id":"CVE-2016-10544","sourceIdentifier":"support@hackerone.com","published":"2018-05-31T20:29:01.643","lastModified":"2026-06-17T00:39:54.650","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used compression will shrink said 256mb down to less than 16mb of websocket payload which passes the length check of 16mb payload. This data will then inflate up to 256mb and crash the node process by exceeding V8's maximum string size. This affects uws >=0.10.0 <=0.10.8."},{"lang":"es","value":"uws es una biblioteca del servidor WebSocket. Mediante el envío de un mensaje websocket de 256 mb a una instancia del servidor uws con permessage-deflate habilitado, existe la posibilidad de que la compresión utilizada comprimirá esos 256 mb a menos de 16 mb de carga útil de websocket, lo que supera la comprobación de longitud de 16 mb de carga útil. Estos datos aumentarán posteriormente a 256 mb y provocarán el cierre inesperado del proceso node excediendo el tamaño máximo de cadena de V8. Esto afecta a uws desde la versión 0.10.0 hasta la 0.10.8."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"HackerOne","product":"uws node module","versions":[{"version":">=0.10.0 <=0.10.8","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:N/A:P","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:uws_project:uws:*:*:*:*:*:node.js:*:*","versionStartIncluding":"0.10.0","versionEndIncluding":"0.10.8","matchCriteriaId":"48FF74BE-2850-4F3F-9E2B-C49A4237CF66"}]}]}],"references":[{"url":"https://github.com/uWebSockets/uWebSockets/commit/37deefd01f0875e133ea967122e3a5e421b8fcd9","source":"support@hackerone.com","tags":["Patch","Third Party Advisory"]},{"url":"https://nodesecurity.io/advisories/149","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://github.com/uWebSockets/uWebSockets/commit/37deefd01f0875e133ea967122e3a5e421b8fcd9","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://nodesecurity.io/advisories/149","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}