{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-21T15:32:59.593","vulnerabilities":[{"cve":{"id":"CVE-2020-7662","sourceIdentifier":"report@snyk.io","published":"2020-06-02T19:15:12.403","lastModified":"2024-11-21T05:37:33.803","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header."},{"lang":"es","value":"El módulo de npm websocket-extensions versiones anteriores a 0.1.4 permite una denegación de servicio (DoS) por medio de Regex Backtracking. El analizador de extensiones puede tardar un tiempo cuadrático cuando analiza un encabezado que contiene un valor de parámetro de cadena no cerrado cuyo contenido es una secuencia repetitiva de dos bytes de una barra diagonal inversa y algún otro carácter. Esto podría ser abusado por un atacante para llevar a cabo una Denegación de Servicio de Regex (ReDoS) en un servidor de un subproceso único al proporcionar una carga útil maliciosa con el encabezado Sec-WebSocket-Extensions"}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:websocket-extensions_project:websocket-extensions:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.1.4","matchCriteriaId":"8DB781EF-866D-46E6-A817-2CB528145B37"}]}]}],"references":[{"url":"https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions","source":"report@snyk.io","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237","source":"report@snyk.io","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv","source":"report@snyk.io","tags":["Exploit","Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-WEBSOCKETEXTENSIONS-570623","source":"report@snyk.io","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-WEBSOCKETEXTENSIONS-570623","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Technical Description","Third Party Advisory"]}]}}]}