p PatchFirst

CVE-2021-32640

CVE-2021-32640 · ReDoS in Sec-Websocket-Protocol header

This page contains facts from public vulnerability sources. Check the original advisory before updating.

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in [email protected] (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.

CVSS 5.3 · Medium · EPSS 2.8% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • ws

    Versions
    • >= 5.0.0 <= 7.4.5: Affected

    No fix published

  • node-ws Debian:12

    Affected ranges
    • ECOSYSTEM: < 7.4.2+~cs18.0.8-2

    Update to 7.4.2+~cs18.0.8-2

  • node-ws Debian:13

    Affected ranges
    • ECOSYSTEM: < 7.4.2+~cs18.0.8-2

    Update to 7.4.2+~cs18.0.8-2

  • node-ws Debian:14

    Affected ranges
    • ECOSYSTEM: < 7.4.2+~cs18.0.8-2

    Update to 7.4.2+~cs18.0.8-2

  • ws npm

    Affected ranges
    • SEMVER: ≥ 7.0.0, < 7.4.6

    Update to 7.4.6

  • ws npm

    Affected ranges
    • SEMVER: ≥ 6.0.0, < 6.2.2

    Update to 6.2.2

  • ws npm

    Affected ranges
    • SEMVER: ≥ 5.0.0, < 5.2.3

    Update to 5.2.3

  • node-ws Ubuntu:16.04:LTS

    Versions
    • 0.7.2+ds1.349b7460-1
    • 1.0.1+ds1.e6ddaae4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ws Ubuntu:18.04:LTS

    Versions
    • 1.1.0+ds1.e6ddaae4-3build1
    • 1.1.0+ds1.e6ddaae4-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ws Ubuntu:20.04:LTS

    Versions
    • 1.1.0+ds1.e6ddaae4-5
    • 7.2.1-2
    • 7.2.1-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ws Ubuntu:22.04:LTS

    Versions
    • 7.4.2+~cs18.0.8-2
    • 7.5.5+~cs13.0.13-1
    • 8.5.0+~cs13.3.3-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →