From 639058b7a1d1e4e971261bacfc3e56ae174055f5 Mon Sep 17 00:00:00 2001 From: iaohkut Date: Wed, 26 Aug 2026 01:34:26 +0700 Subject: [PATCH] Fix unhandled JSON.parse exception on WebSocket message crashes the server (CWE-248) The live-reload WebSocket message handler called JSON.parse() on incoming frames with no try/catch. Combined with the WebSocketServer accepting connections from any origin, any web page open in another browser tab (or any other cross-origin client) could crash the dev server by opening a WebSocket to it and sending a single non-JSON frame. Wrap JSON.parse() in a try/catch and silently ignore malformed messages instead of letting the exception propagate and terminate the process. Verified against the existing test suite (32/32 passing) plus a PoC that previously crashed the server with one malformed WebSocket frame. Co-Authored-By: iaohkut --- server.js | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/server.js b/server.js index d9de0c8..6faf6a1 100644 --- a/server.js +++ b/server.js @@ -1000,7 +1000,12 @@ export default class EleventyDevServer { }, { include: ws }); ws.on("message", (data) => { - let parsed = JSON.parse(data.toString()); + let parsed; + try { + parsed = JSON.parse(data.toString()); + } catch(e) { + return; + } if(parsed.id) { // send acknowledgement this.sendUpdateNotification({