You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
CVE-2024-37890 - High Severity Vulnerability
ws-6.1.2.tgz
Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js
Library home page: https://registry.npmjs.org/ws/-/ws-6.1.2.tgz
Path to dependency file: /scripts/release/package.json
Path to vulnerable library: /scripts/release/package.json
Dependency Hierarchy:
ws-7.3.1.tgz
Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js
Library home page: https://registry.npmjs.org/ws/-/ws-7.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
ws-6.2.1.tgz
Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js
Library home page: https://registry.npmjs.org/ws/-/ws-6.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json,/fixtures/flight/package.json,/fixtures/blocks/package.json
Dependency Hierarchy:
ws-3.3.2.tgz
Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js
Library home page: https://registry.npmjs.org/ws/-/ws-3.3.2.tgz
Path to dependency file: /scripts/bench/package.json
Path to vulnerable library: /scripts/bench/package.json
Dependency Hierarchy:
ws-7.2.1.tgz
Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js
Library home page: https://registry.npmjs.org/ws/-/ws-7.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
ws-5.2.2.tgz
Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js
Library home page: https://registry.npmjs.org/ws/-/ws-5.2.2.tgz
Path to dependency file: /fixtures/blocks/package.json
Path to vulnerable library: /fixtures/blocks/package.json,/fixtures/flight/package.json
Dependency Hierarchy:
Found in HEAD commit: 4669645897ed4ebcd4ee037f4dabb509ed4754c7
Found in base branch: master
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
Publish Date: 2024-06-17
URL: CVE-2024-37890
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-3h5v-q93c-6h6q
Release Date: 2024-06-17
Fix Resolution (ws): 6.2.3
Direct dependency fix Resolution (puppeteer): 3.0.0
Fix Resolution (ws): 6.2.3
Direct dependency fix Resolution (jest-environment-jsdom-sixteen): 2.0.0
Fix Resolution (ws): 6.2.3
Direct dependency fix Resolution (lighthouse): 4.0.0
Fix Resolution (ws): 6.2.3
Direct dependency fix Resolution (react-devtools-core): 4.9.0
Fix Resolution (ws): 6.2.3
Direct dependency fix Resolution (jest): 25.0.0
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: