[Security] DOS vulnerability in ws module required by engine.io module

[jdforsythe]

Note: for support questions, please use one of these channels: stackoverflow or slack

You want to:

• report a bug
• request a feature

Current behaviour

Dependency downstream on ws module

socketio/engine.io#542
https://nodesecurity.io/advisories/550

Steps to reproduce (if the current behaviour is a bug)

Note: the best way to get a quick answer is to provide a failing test case, by forking the following fiddle for example.

Expected behaviour

Setup

• OS:
• browser:
• socket.io version: 2.0.4

Other information (e.g. stacktraces, related issues, suggestions how to fix)

Update to a version of socketio/engine.io with socketio/engine.io#542 fixed

[hello2dj]

like this

[JREAM]

temporary work-around since this is 2 days old from posting.
touch .nsprc

{
  "exceptions":  ["https://nodesecurity.io/advisories/550"]
}

[darrachequesne]

Closed by socketio/engine.io#543 and released as 3.1.4. Sorry for the delay!