CVE-2021-32640mediumCWE-400

CVE-2021-32640: falha de média gravidade em websockets ws

ReDoS in Sec-Websocket-Protocol header

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ws+ Monitorar node-ws

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 2.8%
ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
websockets · ws
CVEs relacionadas — websockets ws

No mesmo produto, das mais perigosas para as menos.

CVE-2026-48779HIGHws: Memory exhaustion DoS from tiny fragments and data chunksEPSS 1.4%CVE-2024-37890HIGHDenial of service when handling a request with many HTTP headers in wsEPSS 1.4%CVE-2026-45736MEDIUMws: Uninitialized memory disclosureEPSS 0.7%