CVE-2021-32640: ReDoS in Sec-Websocket-Protocol header
WebSockets ws library for Node.js is vulnerable to a denial of service, caused by a regular expression denial of service (ReDOS) flaw in the in Sec-Websocket-Protocol header. By sending a specially-crafted regex input, a remote attacker could exploit this vulnerability to cause a slow down on the ws server, and results in a denial of service condition.
Other sources
ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-32640?
CVE-2021-32640 is a vulnerability in the ws library for Node.js that allows a specially crafted value of the `Sec-Websocket-Protocol` header to slow down a ws server.
What software is affected by CVE-2021-32640?
The ws library versions 5.0.0 to 6.2.2 and versions 7.0.0 to 7.4.6 for Node.js are affected. Additionally, the Netapp E-series Performance Analyzer is also affected.
What is the severity of CVE-2021-32640?
CVE-2021-32640 has a severity level of 5.3 (medium).
How can I fix CVE-2021-32640?
To fix CVE-2021-32640, you should update the ws library to version 7.4.6 or higher for Node.js.
Where can I find more information about CVE-2021-32640?
You can find more information about CVE-2021-32640 in the references provided: [link 1](https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff), [link 2](https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693), [link 3](https://lists.apache.org/thread.html/rdfa7b6253c4d6271e31566ecd5f30b7ce1b8fb2c89d52b8c4e0f4e30@%3Ccommits.tinkerpop.apache.org%3E).