Aller au contenu
en Se connecter
7.5 Élevée

CVE-2024-37890 ws is an open source WebSocket client and server for Node.js

Description

ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.

Produits et versions touchés

Produit Versions touchées Corrigé en
ws 8.0 8.0.0 → < 8.17.1 8.17.1
ws 7.0 7.0.0 → < 7.5.10 7.5.10
ws 6.0 6.0.0 → < 6.2.3 6.2.3
ws 2.1 2.1.0 → < 5.2.4 5.2.4

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de ws

Les 5 CVE de ws →
CVE-2026-62389 ws before 8.21.1 contains a memory exhaustion vulnerability in lib/receiver.js where the fragment guard only triggers… 8.7 Élevée CVE-2026-48779 ws is an open source WebSocket client and server for Node.js 7.5 Élevée CVE-2026-45736 ws is an open source WebSocket client and server for Node.js 4.4 Moyenne CVE-2021-32640 ws is an open source WebSocket client and server library for Node.js 5.3 Moyenne
Suivre cette CVE