Loading vulnerability…
ws Denial of Service via Excessive HTTP Headers
CVE-2024-37890 is a denial-of-service vulnerability in the Node.js ws WebSocket client and server library. In vulnerable releases, an HTTP request containing a number of headers exceeding the configured server.maxHeadersCount threshold can cause a ws server process to crash. The issue is fixed in ws 8.17.1 and was backported to ws 7.5.10, 6.2.3, and 5.2.4.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker able to send HTTP requests to a ws server can terminate the server process by submitting a request with excessive HTTP headers. This causes denial of service for WebSocket functionality and potentially for any application availability dependent on the affected process.
If you can’t patch tonight, do this now.
On vulnerable versions, constrain request-header size with the Node.js --max-http-header-size setting and/or the maxHeaderSize server option so that a request cannot contain more headers than server.maxHeadersCount permits. Alternatively, set server.maxHeadersCount to 0 to disable the header-count limit.
Patch, then assume compromise.
Upgrade ws to version 8.17.1 or later, or to the applicable backported fixed release: 7.5.10, 6.2.3, or 5.2.4.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.