Critical Header Overflow Vulnerability in ws WebSocket Package
Summary
CVE-2024-37890: ws is an open source WebSocket client and server for Node.js. Affects node-ws across 4 version ranges.
< 4abd8f6de4b0b65ef80b3ff081989479ed93377e
< 22c28763234aa75a7e1b76f5c01c181260d7917f
< e55e5106f10fcbaac37cfa89759e4cc0d073a52c
< eeb76d313e2a00dd5247ca3597bba7877d064a63
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'ws' package is a widely used open-source WebSocket client and server for Node.js, enabling real-time communication between clients and servers. It is known for its simplicity and performance, making it a popular choice among developers. However, it has recently been identified to have a vulnerability that could lead to server crashes when handling excessive headers in requests.
Vulnerability Detail
The vulnerability, identified as CVE-2024-37890, arises when a request contains a number of headers that exceed the server.maxHeadersCount threshold. This can lead to a denial of service (DoS) condition, where the ws server crashes, rendering it unavailable to handle further requests. The issue is present in multiple versions of the ws package, and it has been addressed in subsequent releases.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, you can mitigate the issue by adjusting the maximum allowed length of the request headers. Use the following options in your server configuration:
- Set the maximum HTTP header size: '--max-http-header-size=size'
- Adjust the server.maxHeadersCount property to 0 to remove any limits, though this may expose your server to other risks.
Conclusion
The ws package has a critical vulnerability that can lead to server crashes due to excessive request headers. It is essential to update to the latest version to mitigate this risk. Additionally, users can implement workarounds to limit header sizes until they can perform the update.
See every vulnerability recorded for node-ws →
FAQ
CVE-2024-37890 is a vulnerability in the ws WebSocket package that allows excessive headers in requests, potentially crashing the server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Affected versions include all versions prior to ws@8.17.1, as well as specific versions in the 7.x, 6.x, and 5.x series.
Failing to address this vulnerability can lead to denial of service attacks, where your WebSocket server becomes unresponsive due to crashes.
You can check your current version by running 'npm list ws' in your terminal and update it using 'npm install ws@latest'.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-ws.
