CVE-2021-32640: ReDoS in Sec-Websocket-Protocol header in ws
Summary
CVE-2021-32640: ReDoS in Sec-Websocket-Protocol header. Affects ws across 3 version ranges.
>= 5.0.0, < 5.2.3
>= 6.0.0, < 6.2.2
>= 7.0.0, < 7.4.6
Fixed in 5.2.3, 6.2.2 or 7.4.6, depending on the release line you run. How to fix ↓
Also tracked for
- node-ws · Debian:11
The same CVE-2021-32640 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'ws' package is an npm package used for WebSocket server and client implementation. It provides a simple and efficient way to establish WebSocket connections in Node.js. The package allows developers to create WebSocket servers and clients, handle WebSocket events, and exchange data in real-time. However, the package is vulnerable to a Regular Expression Denial of Service (ReDoS) attack when processing the 'Sec-Websocket-Protocol' header.
Vulnerability Detail
The vulnerability in the 'ws' package arises from a flaw in the processing of the 'Sec-Websocket-Protocol' header. An attacker can exploit this vulnerability by sending a specially crafted value in the header, causing the WebSocket server to slow down significantly. This can lead to a denial of service (DoS) condition, impacting the availability of the server. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 8.22.0 as of 22 Oct 2026
npm install ws@8.22.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.0.0, < 5.2.35.2.3npm install ws@5.2.3 -
>= 6.0.0, < 6.2.26.2.2npm install ws@6.2.2 -
>= 7.0.0, < 7.4.67.4.6npm install ws@7.4.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
In vulnerable versions of 'ws', the issue can be mitigated by reducing the maximum allowed length of the request headers using the '--max-http-header-size=size' command-line option or the 'maxHeaderSize' option in the 'http.createServer()' function. By limiting the header size, the impact of the vulnerability can be minimized. Here is an example of reducing the maximum header size using the command-line option: node --max-http-header-size=8192 server.js
Conclusion
The 'ws' package is vulnerable to a ReDoS attack when processing the 'Sec-Websocket-Protocol' header. This can lead to a denial of service (DoS) condition, impacting the availability of the WebSocket server. It is crucial to update the package to the latest version (7.4.6 or later) to fix the vulnerability. Additionally, reducing the maximum allowed length of request headers can serve as a temporary workaround. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ws →
FAQ
The vulnerability allows an attacker to slow down a WebSocket server significantly, leading to a denial of service (DoS) condition. This can impact the availability of the server and disrupt its normal operation.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
Yes, in vulnerable versions of 'ws', you can mitigate the issue by reducing the maximum allowed length of the request headers using the '--max-http-header-size=size' command-line option or the 'maxHeaderSize' option in the 'http.createServer()' function.
Yes, the vulnerability has been fixed in 'ws' package versions 7.4.6, 6.2.2, and 5.2.3. It is recommended to update to the latest version to ensure the security of your application.
The vulnerability was responsibly disclosed by Robert McLaughlin from the University of California, Santa Barbara. They reported the vulnerability privately and provided a fix along with the disclosure.
References
Related vulnerabilities
Recent vulnerabilities recorded for ws.
