{"id":"CVE-2021-32640","aliases":["AZL-44670","CLSA-2026-1785380875","CLSA-2026-1788560420","CLSA-2026-1788560439","CLSA-2026-1792164186","CLSA-2026-1792443025","CLSA-2026-1793112519","DEBIAN-CVE-2021-32640","EUVD-2021-0968","GHSA-6fc8-4gx4-v693","UBUNTU-CVE-2021-32640"],"status":"published","title":"ReDoS in Sec-Websocket-Protocol header","description":"ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02821,"percentile":0.86693,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-345","CWE-400"],"published":"2021-05-25T18:25:09Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"ws","fixed_in":["7.4.6","6.2.2","5.2.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"ws","fixed_in":["6.2.1-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-ws","fixed_in":["7.4.2+~cs18.0.8-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-ws","fixed_in":["7.4.2+~cs18.0.8-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-ws","fixed_in":["7.4.2+~cs18.0.8-2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.4.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.2.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.2.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1-tuxcare.0"},{"fixed":"6.2.1-tuxcare.2"}]}],"versions":["6.2.1","6.2.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.5-tuxcare.0"},{"fixed":"7.4.5-tuxcare.1"}]}],"versions":["7.4.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0-tuxcare.0"},{"fixed":"6.0.0-tuxcare.1"}]}],"versions":["6.0.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.3-tuxcare.0"},{"fixed":"7.4.3-tuxcare.1"}]}],"versions":["7.4.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.0-tuxcare.0"},{"fixed":"7.4.0-tuxcare.1"}]}],"versions":["7.4.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.4-tuxcare.0"},{"fixed":"6.1.4-tuxcare.1"}]}],"versions":["6.1.4"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2+~cs18.0.8-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2+~cs18.0.8-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2+~cs18.0.8-2"}]}]},{"source":"osv","ecosystem":"npm","package":"ws","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.4.6"}]}]},{"source":"osv","ecosystem":"npm","package":"ws","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.2.2"}]}]},{"source":"osv","ecosystem":"npm","package":"ws","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.2.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.2+ds1.349b7460-1","1.0.1+ds1.e6ddaae4-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0+ds1.e6ddaae4-3build1","1.1.0+ds1.e6ddaae4-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0+ds1.e6ddaae4-5","7.2.1-2","7.2.1-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.4.2+~cs18.0.8-2","7.5.5+~cs13.0.13-1","8.5.0+~cs13.3.3-2"]}],"products":[{"vendor":"netapp","product":"e-series_performance_analyzer"},{"vendor":"websockets","product":"ws"},{"vendor":"ws_project","product":"ws"}],"references":[{"url":"https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Mitigation","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.apache.org/thread.html/rdfa7b6253c4d6271e31566ecd5f30b7ce1b8fb2c89d52b8c4e0f4e30%40%3Ccommits.tinkerpop.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210706-0005/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32640","tags":["web","advisory"]},{"url":"https://github.com/websockets/ws/issues/1895","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rdfa7b6253c4d6271e31566ecd5f30b7ce1b8fb2c89d52b8c4e0f4e30@%3Ccommits.tinkerpop.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6fc8-4gx4-v693"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-32640","tags":["advisory"]},{"url":"https://github.com/websockets/ws","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20210706-0005","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-32640","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32640","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-32640","title":"ReDoS in Sec-Websocket-Protocol header","description":"ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.","status":"published","published":"2021-05-25T18:25:09Z","modified":"2024-08-03T23:25:31.019Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:33:07.349244Z"}],"euvd":[{"id":"EUVD-2021-0968","description":"ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.","status":"published","published":"2021-05-25T18:25:09Z","modified":"2024-08-03T23:25:31Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T03:24:36.41075Z"}],"ghsa":[{"id":"GHSA-6fc8-4gx4-v693","title":"ReDoS in Sec-Websocket-Protocol header","description":"### Impact\n\nA specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server.\n\n### Proof of concept\n\n```js\nfor (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {\n  const value = 'b' + ' '.repeat(length) + 'x';\n  const start = process.hrtime.bigint();\n\n  value.trim().split(/ *, */);\n\n  const end = process.hrtime.bigint();\n\n  console.log('length = %d, time = %f ns', length, end - start);\n}\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff) and backported to ws@6.2.2 (https://github.com/websockets/ws/commit/78c676d2a1acefbc05292e9f7ea0a9457704bf1b) and ws@5.2.3 (https://github.com/websockets/ws/commit/76d47c1479002022a3e4357b3c9f0e23a68d4cd2).\n\n### Workarounds\n\nIn vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.\n\n### Credits\n\nThe vulnerability was responsibly disclosed along with a fix in private by [Robert McLaughlin](https://github.com/robmcl4) from University of California, Santa Barbara.\n","status":"published","published":"2021-05-28T19:19:03Z","modified":"2023-02-03T05:02:42Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-345","CWE-400"],"updated_at":"2026-11-02T14:36:41.967989Z"}],"nvd":[{"id":"CVE-2021-32640","description":"ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.","status":"published","published":"2021-05-25T19:15:07.767Z","modified":"2026-06-17T03:53:19.733Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:06:53.987491Z"}],"osv":[{"id":"AZL-44670","title":"CVE-2021-32640 affecting package js-jquery 3.5.0-4","description":"ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.","status":"published","published":"2021-05-25T19:15:07Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"CVE-2021-32640","description":"ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.","status":"published","published":"2021-05-25T19:15:07.767Z","modified":"2026-10-20T10:54:41.77979287Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"DEBIAN-CVE-2021-32640","description":"ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.","status":"published","published":"2021-05-25T19:15:07.767Z","modified":"2026-10-23T18:03:03.601059783Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"GHSA-6fc8-4gx4-v693","title":"ReDoS in Sec-Websocket-Protocol header","description":"### Impact\n\nA specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server.\n\n### Proof of concept\n\n```js\nfor (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {\n  const value = 'b' + ' '.repeat(length) + 'x';\n  const start = process.hrtime.bigint();\n\n  value.trim().split(/ *, */);\n\n  const end = process.hrtime.bigint();\n\n  console.log('length = %d, time = %f ns', length, end - start);\n}\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff) and backported to ws@6.2.2 (https://github.com/websockets/ws/commit/78c676d2a1acefbc05292e9f7ea0a9457704bf1b) and ws@5.2.3 (https://github.com/websockets/ws/commit/76d47c1479002022a3e4357b3c9f0e23a68d4cd2).\n\n### Workarounds\n\nIn vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.\n\n### Credits\n\nThe vulnerability was responsibly disclosed along with a fix in private by [Robert McLaughlin](https://github.com/robmcl4) from University of California, Santa Barbara.\n","status":"published","published":"2021-05-28T19:19:03Z","modified":"2026-07-08T06:28:00.103808643Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-345","CWE-400"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"UBUNTU-CVE-2021-32640","description":"ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.","status":"published","published":"2021-05-25T19:15:00Z","modified":"2025-10-24T04:50:20Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"CLSA-2026-1785380875","title":"TuxCare security update for ws (1 CVE)","description":"TuxCare rebuilt ws to address 1 CVE. Fixed in 6.2.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:47:37.374176215Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1788560420","title":"TuxCare security update for ws (3 CVEs)","description":"TuxCare rebuilt ws to address 3 CVEs. Fixed in 7.4.5-tuxcare.1.","status":"published","published":"2026-09-04T22:20:20Z","modified":"2026-10-15T09:48:03.16737666Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788560439","title":"TuxCare security update for ws (3 CVEs)","description":"TuxCare rebuilt ws to address 3 CVEs. Fixed in 6.0.0-tuxcare.1.","status":"published","published":"2026-09-04T22:20:39Z","modified":"2026-10-15T09:48:03.103525841Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1792164186","title":"TuxCare security update for ws (3 CVEs)","description":"TuxCare rebuilt ws to address 3 CVEs. Fixed in 7.4.3-tuxcare.1.","status":"published","published":"2026-10-16T15:23:06Z","modified":"2026-10-16T16:32:00.365190497Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792443025","title":"TuxCare security update for ws (3 CVEs)","description":"TuxCare rebuilt ws to address 3 CVEs. Fixed in 7.4.0-tuxcare.1.","status":"published","published":"2026-10-19T20:50:25Z","modified":"2026-10-20T01:45:11.700371544Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793112519","title":"TuxCare security update for ws (3 CVEs)","description":"TuxCare rebuilt ws to address 3 CVEs. Fixed in 6.1.4-tuxcare.1.","status":"published","published":"2026-10-27T14:48:39Z","modified":"2026-10-27T19:30:02.389047138Z","updated_at":"2026-11-02T15:43:55.34846Z"}]}}