webfm (>=0.9.0, <=0.9.37) potentially affected by CVE-2018-21036 via sails-hook-sockets (1.4.3)

sails-hook-sockets NPM version 1.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on sails-hook-sockets and may be impacted: - webfm =0.9.0, =0.9.37 Source cves: CVE-2018-21036 Source advisory: OSV:GHSA-F7F4-HQP2-7PRC...

Denial Of Service (DoS)

sails-hook-sockets is vulnerable to denial of service DoS. An attacker can send a WebSocket request with an empty string to the URL pathname variable to trigger an application crash as the error was not handled...