CVE-2021-32640
Description
ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in [email protected] (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.
How to fix
- ws_project ws6.2.2, 7.4.6 or later
- ws7.4.6, 6.2.2, 5.2.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ws_project ws | 5.0.0 ≤ v < 6.2.2, 7.0.0 ≤ v < 7.4.6 | 6.2.2, 7.4.6 |
| netapp e-series_performance_analyzer | No range specified | — |
| wsnpm | 7.0.0 ≤ v < 7.4.6, 6.0.0 ≤ v < 6.2.2, 5.0.0 ≤ v < 5.2.3 | 7.4.6, 6.2.2, 5.2.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.