CVE-2021-32640

Name of the Vulnerable Software and Affected Versions ws versions prior to 7.4.6 ws versions prior to 6.2.2 ws versions prior to 5.2.3

Description A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server, potentially leading to a denial of service. The issue is related to the incorrect interpretation of the Sec-Websocket-Protocol header.

Recommendations For ws versions prior to 7.4.6, update to ws@7.4.6 or later. For ws versions prior to 6.2.2, update to ws@6.2.2 or later. For ws versions prior to 5.2.3, update to ws@5.2.3 or later. As a temporary workaround, consider reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.