CVE-2024-37890

Denial of service when handling a request with many HTTP headers in ws

Description

ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.

Category

7.5
CVSS
Severity: High
CVSS 3.1 •
EPSS 0.32%
Affected: websockets ws
Published at:
Updated at:

References

Link Tags
https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
https://github.com/websockets/ws/issues/2230
https://github.com/websockets/ws/pull/2231
https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
https://nodejs.org/api/http.html#servermaxheaderscount

Frequently Asked Questions

What is the severity of CVE-2024-37890?
CVE-2024-37890 has been scored as a high severity vulnerability.
How to fix CVE-2024-37890?
To fix CVE-2024-37890, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-37890 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-37890 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-37890?
CVE-2024-37890 affects websockets ws.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.