CVE-2021-32640

    Dashboard / Vulnerabilities / CVE-2021-32640

    CVE-2021-32640

    Published: 25 May 2021Last Modified: 9 Jul 2026

    Summary:

    Details: ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in [email protected] (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.

    References: https://lists.apache.org/thread.html/rdfa7b6253c4d6271e31566ecd5f30b7ce1b8fb2c89d52b8c4e0f4e30%40%3Ccommits.tinkerpop.apache.org%3E, https://security.netapp.com/advisory/ntap-20210706-0005/, https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff, https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- d3af50627de62b0d8b9c42d915e8c6a426238363
    Fixed -9bdb58070d64c33a9beeac7c732aac0f4e7e18b7

    Affected versions

    6.2.1
    6.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-32640 | CVE-DB