p PatchFirst

CVE-2024-37890

CVE-2024-37890 · Denial of service when handling a request with many HTTP headers in ws

This page contains facts from public vulnerability sources. Check the original advisory before updating.

ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] (e55e510) and backported to [email protected] (22c2876), [email protected] (eeb76d3), and [email protected] (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.

CVSS 7.5 · High · EPSS 1.4% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • ws

    Versions
    • >= 2.1.0, < 5.2.4: Affected
    • >= 6.0.0, < 6.2.3: Affected
    • >= 7.0.0, < 7.5.10: Affected
    • >= 8.0.0, < 8.17.1: Affected

    No fix published

  • node-ws Debian:12

    Versions
    • 8.11.0+~cs13.7.3-1
    • 8.11.0+~cs13.7.3-2
    • 8.18.0+~cs13.7.11-1
    • 8.18.0+~cs14.5.15-1
    • 8.18.1+~cs14.18.2-1
    • 8.19.0+~cs14.19.1-1
    • 8.20.1+~cs14.19.1-1
    • 8.21.0+~cs14.19.1-1
    • 8.21.1+~cs14.19.1-1
    • 8.21.3+~cs14.19.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ws Debian:13

    Affected ranges
    • ECOSYSTEM: < 8.18.0+~cs13.7.11-1

    Update to 8.18.0+~cs13.7.11-1

  • node-ws Debian:14

    Affected ranges
    • ECOSYSTEM: < 8.18.0+~cs13.7.11-1

    Update to 8.18.0+~cs13.7.11-1

  • ws npm

    Affected ranges
    • SEMVER: ≥ 2.1.0, < 5.2.4

    Update to 5.2.4

  • ws npm

    Affected ranges
    • SEMVER: ≥ 6.0.0, < 6.2.3

    Update to 6.2.3

  • ws npm

    Affected ranges
    • SEMVER: ≥ 7.0.0, < 7.5.10

    Update to 7.5.10

  • ws npm

    Affected ranges
    • SEMVER: ≥ 8.0.0, < 8.17.1

    Update to 8.17.1

  • node-ws Ubuntu:16.04:LTS

    Versions
    • 0.7.2+ds1.349b7460-1
    • 1.0.1+ds1.e6ddaae4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ws Ubuntu:18.04:LTS

    Versions
    • 1.1.0+ds1.e6ddaae4-3build1
    • 1.1.0+ds1.e6ddaae4-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ws Ubuntu:20.04:LTS

    Versions
    • 1.1.0+ds1.e6ddaae4-5
    • 7.2.1-2
    • 7.2.1-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ws Ubuntu:22.04:LTS

    Versions
    • 7.4.2+~cs18.0.8-2
    • 7.5.5+~cs13.0.13-1
    • 8.5.0+~cs13.3.3-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ws Ubuntu:24.04:LTS

    Versions
    • 8.11.0+~cs13.7.3-1
    • 8.11.0+~cs13.7.3-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ws Ubuntu:25.10

    Versions
    • 8.18.0+~cs14.5.15-1
    • 8.18.1+~cs14.18.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ws Ubuntu:26.10

    Versions
    • 8.19.0+~cs14.19.1-1
    • 8.20.1+~cs14.19.1-1
    • 8.21.3+~cs14.19.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-ws Ubuntu:26.04:LTS

    Versions
    • 8.18.1+~cs14.18.2-1
    • 8.19.0+~cs14.19.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →