CVE-2021-32640: ReDoS in Sec-Websocket-Protocol header
ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wsto a version that resolves this vulnerability.Fixed in 7.4.6 - Configuration
Reduce the maximum allowed length of request headers using the --max-http-header-size=size CLI option and/or the maxHeaderSize server option.
Node.js HTTP server --max-http-header-size / maxHeaderSize = reduced maximum allowed request-header length
Event History
Frequently Asked Questions
What is CVE-2021-32640?
CVE-2021-32640 is a vulnerability in the ws library for Node.js that allows a specially crafted value of the `Sec-Websocket-Protocol` header to slow down a ws server.
What software is affected by CVE-2021-32640?
The ws library versions 5.0.0 to 6.2.2 and versions 7.0.0 to 7.4.6 for Node.js are affected. Additionally, the Netapp E-series Performance Analyzer is also affected.
What is the severity of CVE-2021-32640?
CVE-2021-32640 has a severity level of 5.3 (medium).
How can I fix CVE-2021-32640?
To fix CVE-2021-32640, you should update the ws library to version 7.4.6 or higher for Node.js.
Where can I find more information about CVE-2021-32640?
You can find more information about CVE-2021-32640 in the references provided: [link 1](https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff), [link 2](https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693), [link 3](https://lists.apache.org/thread.html/rdfa7b6253c4d6271e31566ecd5f30b7ce1b8fb2c89d52b8c4e0f4e30@%3Ccommits.tinkerpop.apache.org%3E).