Vulnerability · Published Jun 17, 2024 · Assigned by GitHub_M
CVE-2024-37890Denial of service when handling a request with many HTTP headers in ws
High 7.5
In plain English
A high-severity null pointer dereference in ws from websockets. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-ws | no fix listed | DEBIAN-CVE-2024-37890 |
| Debian:13 | node-ws | 8.18.0+~cs13.7.11-1 | DEBIAN-CVE-2024-37890 |
| Debian:14 | node-ws | 8.18.0+~cs13.7.11-1 | DEBIAN-CVE-2024-37890 |
| Ubuntu:22.04:LTS | node-ws | no fix listed | UBUNTU-CVE-2024-37890 |
| Ubuntu:24.04:LTS | node-ws | no fix listed | UBUNTU-CVE-2024-37890 |
| Ubuntu:25.10 | node-ws | no fix listed | UBUNTU-CVE-2024-37890 |
| Ubuntu:26.04:LTS | node-ws | no fix listed | UBUNTU-CVE-2024-37890 |
| Ubuntu:26.10 | node-ws | no fix listed | UBUNTU-CVE-2024-37890 |
| npm | ws | 8.17.1 | GHSA-3h5v-q93c-6h6q |
| npm | ws | 7.5.10 | GHSA-3h5v-q93c-6h6q |
| npm | ws | 6.2.3 | GHSA-3h5v-q93c-6h6q |
| npm | ws | 5.2.4 | GHSA-3h5v-q93c-6h6q |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| websockets | ws | >= 2.1.0, < 5.2.4>= 6.0.0, < 6.2.3>= 7.0.0, < 7.5.10>= 8.0.0, < 8.17.1 |
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q x_refsource_CONFIRM
- https://github.com/websockets/ws/issues/2230 x_refsource_MISC
- https://github.com/websockets/ws/pull/2231 x_refsource_MISC
- https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f x_refsource_MISC
- https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e x_refsource_MISC
- https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c x_refsource_MISC
- https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63 x_refsource_MISC
- https://nodejs.org/api/http.html#servermaxheaderscount x_refsource_MISC