Language: TypeScript
Label: vulnerable
CWE: CWE-248 \u2014 Uncaught Exception
An exception is thrown from a function, but it is not caught.

Code:
  public handleUpgrade(
    req: IncomingMessage,
    socket: Duplex,
    upgradeHead: Buffer
  ) {
    this.prepare(req);

    const res = new WebSocketResponse(req, socket);
    const callback = (errorCode, errorContext) => {
      if (errorCode) {
        this.emit("connection_error", {
          req,
          code: errorCode,
          message: Server.errorMessages[errorCode],
          context: errorContext,
        });
        abortUpgrade(socket, errorCode, errorContext);
        return;
      }

      const head = Buffer.from(upgradeHead);
      upgradeHead = null;

      // some middlewares (like express-session) wait for the writeHead() call to flush their headers
      // see https://github.com/expressjs/session/blob/1010fadc2f071ddf2add94235d72224cf65159c6/index.js#L220-L244
      res.writeHead();

      // delegate to ws
      this.ws.handleUpgrade(req, socket, head, (websocket) => {
        this.onWebSocket(req, socket, websocket);
      });
    };

    this._applyMiddlewares(req, res as unknown as ServerResponse, (err) => {
      if (err) {
        callback(Server.errors.BAD_REQUEST, { name: "MIDDLEWARE_FAILURE" });
      } else {
        this.verify(req, true, callback);
      }
    });
  }