Security readout for executives and security teams
Plain-English summary
CVE-2016-10542 is a denial-of-service issue in the ws Node.js WebSocket module. A server using ws 1.1.0 or earlier can have its Node process crashed by an overly long WebSocket payload, interrupting real-time application features and any service sharing that process.
Executive priority
Treat as a targeted availability risk for legacy Node.js WebSocket services. Prioritize internet-facing or customer-facing systems first, especially where a process crash would affect revenue, operations, or support obligations.
Technical view
The source bundle describes CWE-400 uncontrolled resource consumption in ws <=1.1.0. The vulnerable condition is triggered by an overly long WebSocket payload sent to a ws server, causing the Node process to crash. No CVSS vector, CPE list, or detailed patch metadata is included.
Likely exposure
Exposure is most likely in older Node.js applications that run public or partner-facing WebSocket endpoints and depend on ws 1.1.0 or earlier. Modern applications using newer ws versions are not identified as affected in the provided sources.
Exploitation context
The provided sources support remote denial-of-service potential against affected ws servers. They do not indicate active exploitation, KEV listing, exploit maturity, authentication requirements, or public weaponization details.
Researcher notes
The bundle is sparse: it names the vulnerable package, affected version range, crash condition, and CWE, but lacks CVSS, fixed-version details, and exploitation telemetry. Avoid claiming more than denial-of-service unless additional vendor evidence is reviewed.
Mitigation direction
- Inventory Node.js applications using the ws package.
- Flag deployments using ws 1.1.0 or earlier.
- Upgrade ws beyond the affected range after checking vendor guidance.
- Limit request sizes and monitor WebSocket crash patterns where feasible.
- Restart affected services under process supervision until remediation is complete.
Validation and detection
- Review package-lock.json, yarn.lock, pnpm-lock.yaml, or SBOMs for ws versions.
- Confirm whether affected applications expose WebSocket server endpoints.
- Check runtime dependency trees for transitive ws <=1.1.0 usage.
- Review service logs for Node process crashes linked to WebSocket traffic.
- Document any compensating controls around payload limits and service restarts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2016-10542 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/nodejs/node/issues/7388CVE reference · x_refsource_MISC
- https://nodesecurity.io/advisories/120CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.