webfm (>=0.9.0, <=0.9.37) potentially affected by CVE-2018-21036 via sails-hook-sockets (1.4.3)

sails-hook-sockets NPM version 1.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on sails-hook-sockets and may be impacted: - webfm =0.9.0, =0.9.37 Source cves: CVE-2018-21036 Source advisory: OSV:GHSA-F7F4-HQP2-7PRC...

Denial Of Service (DoS)

sails-hook-sockets is vulnerable to denial of service DoS. An attacker can send a WebSocket request with an empty string to the URL pathname variable to trigger an application crash as the error was not handled...

CVE-2018-21036: Improper Input Validation

Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request...