Skip to content
fr Sign in
7.5 High

CVE-2024-37890 ws is an open source WebSocket client and server for Node.js

Description

ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.

Affected products and versions

Product Affected versions Fixed in
ws 8.0 8.0.0 → < 8.17.1 8.17.1
ws 7.0 7.0.0 → < 7.5.10 7.5.10
ws 6.0 6.0.0 → < 6.2.3 6.2.3
ws 2.1 2.1.0 → < 5.2.4 5.2.4

References

Timeline

  1. Published
  2. Last modified

Other CVEs of ws

The 5 CVEs of ws →
CVE-2026-62389 ws before 8.21.1 contains a memory exhaustion vulnerability in lib/receiver.js where the fragment guard only triggers… 8.7 High CVE-2026-48779 ws is an open source WebSocket client and server for Node.js 7.5 High CVE-2026-45736 ws is an open source WebSocket client and server for Node.js 4.4 Medium CVE-2021-32640 ws is an open source WebSocket client and server library for Node.js 5.3 Medium
Track this CVE