ws: WebSocket Client and Server Vulnerability
CVE-2024-37890
What is CVE-2024-37890?
The ws library, an open-source WebSocket client and server for Node.js, is susceptible to a vulnerability that can lead to server crashes when excessive headers are sent in a request. When headers exceed the threshold defined by server.maxHeadersCount, the server may become unresponsive. This issue has been addressed in [email protected] and has been backported to earlier versions such as [email protected], [email protected], and [email protected]. To mitigate the vulnerability in the affected versions, administrators can adjust the maximum allotted header size by utilizing the --max-http-header-size option or the maxHeaderSize property. Alternatively, setting server.maxHeadersCount to 0 removes any limit on the number of headers processed, although this is not recommended due to potential security implications.
Affected Version(s)
ws >= 2.1.0, < 5.2.4 < 2.1.0, 5.2.4
ws >= 6.0.0, < 6.2.3 < 6.0.0, 6.2.3
ws >= 7.0.0, < 7.5.10 < 7.0.0, 7.5.10