CVE-2024-37890: Denial of Service in ws Package
Summary
CVE-2024-37890: ws affected by a DoS when handling a request with many HTTP headers. Affects ws across 4 version ranges.
>= 2.1.0, < 5.2.4
>= 6.0.0, < 6.2.3
>= 7.0.0, < 7.5.10
>= 8.0.0, < 8.17.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- node-ws · Debian:11
The same CVE-2024-37890 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ws package is an npm package used for WebSocket communication in Node.js applications. It provides a WebSocket server and client implementation. The vulnerability in the ws package allows an attacker to cause a Denial of Service (DoS) by sending a request with a large number of headers, exceeding the server's maximum allowed header count. This vulnerability affects versions 2.1.0 and above of the ws package.
Vulnerability Detail
The vulnerability in the ws package arises from a lack of proper validation and handling of requests with excessive headers. When a request with a number of headers exceeding the server's maximum allowed header count is received, it can cause the ws server to crash. This can lead to a DoS situation, where the server becomes unresponsive and unable to handle legitimate requests. The impact of this vulnerability is limited to the availability of the WebSocket server and does not directly result in unauthorized access or data compromise.
How To Fix
Latest published version: 8.22.0 as of 22 Oct 2026
npm install ws@8.22.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.1.0, < 5.2.45.2.4npm install ws@5.2.4 -
>= 6.0.0, < 6.2.36.2.3npm install ws@6.2.3 -
>= 7.0.0, < 7.5.107.5.10npm install ws@7.5.10 -
>= 8.0.0, < 8.17.18.17.1npm install ws@8.17.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the ws package is not immediately feasible, there are two workarounds to mitigate the vulnerability. First, the maximum allowed length of request headers can be reduced using the --max-http-header-size=size and/or the maxHeaderSize options, ensuring that no more headers than the server's maximum allowed count can be sent. Second, the server.maxHeadersCount can be set to 0, removing the limit on the number of headers. However, these workarounds may have other implications and should be carefully evaluated before implementation.
Conclusion
The ws package is vulnerable to a Denial of Service (DoS) attack when handling requests with excessive headers. This vulnerability can be mitigated by updating the package to version 8.17.1 or later. Alternatively, workarounds involving header length reduction or removing the header count limit can be implemented. It is important to address this vulnerability to ensure the availability and stability of WebSocket communication in Node.js applications.
See every vulnerability recorded for ws →
FAQ
The vulnerability allows an attacker to crash the ws server by sending a request with excessive headers, leading to a Denial of Service (DoS) situation where the server becomes unresponsive.
No, this vulnerability does not directly result in unauthorized access or data compromise. Its impact is limited to the availability of the WebSocket server.
Versions 2.1.0 and above of the ws package are affected by this vulnerability.
Updating the ws package to version 8.17.1 or later fixes this vulnerability. Proper validation and handling of requests with excessive headers are implemented in the updated versions.
Yes, two workarounds can be implemented. First, the maximum allowed length of request headers can be reduced. Second, the server.maxHeadersCount can be set to 0 to remove the limit on the number of headers. However, these workarounds may have other implications and should be carefully evaluated.
References
Related vulnerabilities
Recent vulnerabilities recorded for ws.
