CVE-2021-32640

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

References

Affected packages

Git / github.com/websockets/ws

Affected ranges

Type

GIT

Repo

https://github.com/websockets/ws

Events

Introduced

d3af50627de62b0d8b9c42d915e8c6a426238363

Fixed

9bdb58070d64c33a9beeac7c732aac0f4e7e18b7

Introduced

092a822a41eb22f6d6745c18bc29b9c40715680f

Fixed

f5297f7090f6a628832a730187c5b3a06a247f00

Fixed

00c425ec77993773d823f018f64a5c44e17023ff

Database specific

Show details

{
    "cpe": "cpe:2.3:a:ws_project:ws:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "6.2.2"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.4.6"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

5.*

5.0.0

5.1.0

5.1.1

5.2.0

5.2.1

6.*

6.0.0

6.1.0

6.1.1

6.1.2

6.1.3

6.1.4

6.2.0

6.2.1

7.*

7.0.0

7.0.1

7.1.0

7.1.1

7.1.2

7.2.0

7.2.1

7.2.2

7.2.3

7.2.4

7.2.5

7.3.0

7.3.1

7.4.0

7.4.1

7.4.2

7.4.3

7.4.4

7.4.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32640.json"