CVE-2026-54490: 
JavaScript 취약성 분석 및 완화

CVE-2026-54490 is a resource limit bypass vulnerability in the websocket-driver npm package (used by the faye-websocket ecosystem) that allows WebSocket messages to exceed the configured maximum message size when the permessage-deflate compression extension is enabled. The flaw affects all versions prior to 0.7.5 of websocket-driver-node. It was discovered by Pranjali Thakur of the DepthFirst Security Research Team, first published on June 4, 2026, and added to the GitHub Advisory Database on July 15, 2026. The vulnerability carries a CVSS v4 base score of 6.3 (Medium) (Github Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). In lib/websocket/driver/hybi.js, the maximum message size check is performed against the compressed frame length headers rather than the decompressed payload size. When the permessage-deflate extension is active, an attacker can craft a WebSocket message that is small in its compressed form but expands significantly upon decompression, bypassing the configured size limit entirely. The fix (commit c55679a) adds a post-decompression length check — if (payload.length > this._maxLength) return this._fail('too_large', 'WebSocket frame length too large') — applied after extension processing (Github Advisory, Patch Commit).

Successful exploitation causes affected WebSocket servers or clients to accept and process messages significantly larger than their configured maximum, leading to excessive memory and CPU consumption beyond intended resource limits. The primary impact is on availability — applications may experience degraded performance, increased memory pressure, or denial of service conditions if an attacker repeatedly sends highly compressible payloads. There is no confidentiality or integrity impact; the vulnerability does not enable code execution or data exfiltration (Github Advisory).

1. Identify target: Locate a Node.js application using websocket-driver < 0.7.5 with the permessage-deflate extension enabled — this is often the default in frameworks built on faye-websocket.
2. Establish WebSocket connection: Connect to the target WebSocket endpoint, negotiating the permessage-deflate extension during the handshake (include Sec-WebSocket-Extensions: permessage-deflate in the upgrade request).
3. Craft compressed payload: Construct a WebSocket message containing highly compressible data (e.g., a large repetitive string) that compresses to a size below the server's configured maxLength limit but decompresses to a much larger payload (zip bomb-style technique).
4. Send oversized messages: Transmit the crafted compressed frames repeatedly; the server checks only the compressed frame length header, accepts the frames, and decompresses them into memory, consuming resources far beyond the intended limit.
5. Achieve resource exhaustion: Repeated transmission of such messages causes the server process to consume excessive memory or CPU, potentially degrading or denying service to legitimate users (Github Advisory, Patch Commit).

• Network: Unusual WebSocket connections with Sec-WebSocket-Extensions: permessage-deflate negotiated, followed by a high volume of small compressed frames from a single source IP.
• Process: Node.js process exhibiting abnormally high memory consumption or CPU usage correlated with WebSocket activity; heap size growing unexpectedly during WebSocket message handling.
• Logs: Application logs showing repeated large message processing events or out-of-memory errors originating from WebSocket handler code; error logs referencing hybi.js or WebSocket frame processing.
• Network: Connections sending many frames with compressed sizes well below the configured maxLength threshold but causing disproportionate server resource usage.

The vulnerability is fixed in websocket-driver version 0.7.5, which checks message length after decompression by incoming extensions. All users should upgrade immediately by running npm install websocket-driver@0.7.5 or updating their package.json dependency. No configuration-based workarounds exist; the only remediation is upgrading to the patched version. Applications using faye-websocket or other packages that depend on websocket-driver should also verify their transitive dependency is updated (Github Advisory).

The vulnerability was discovered and responsibly disclosed by Pranjali Thakur of the DepthFirst Security Research Team. The maintainer (jcoglan) published the advisory and patch promptly. No significant broader media coverage or notable community commentary beyond standard vulnerability database aggregation has been observed for this moderate-severity issue (Github Advisory).