Skip to content

v2.3.0

Choose a tag to compare

View all tags
@cressie176 cressie176 released this 08 Nov 13:40
· 7 commits to main since this release
v2.3.0
2759ae8

Security release addressing GHSA-37f9-7m79-6866 (frame-handling denial of service reachable by a malicious or non-compliant broker).

  • Reject a connection.tune whose frameMax is below the protocol minimum of 4096, and guard sendContent so an undersized frameMax can no longer send publishing into an unbounded loop.
  • Add a maxFrameSize connection option (also a URL query parameter) bounding the size of incoming frames, checked from the frame header alone. Default 64 MiB (or the negotiated frameMax if larger); 0 disables it. Kept separate from the negotiated frameMax so brokers that send larger unsplit frames (see #784) still work.

Reported by Rizwan Bedekar (https://github.com/r-bedekar).

Assets 2
Loading