Packages / ws / Security

ModerateVulnerabilityGHSA-6fc8-4gx4-v693CVE-2021-32640Published 28 May 2021

ReDoS in Sec-Websocket-Protocol header

Affected releases · ws

  • 7.x7.0.0 – 7.4.5Fixed in 7.4.6
  • 6.x6.0.0 – 6.2.1Fixed in 6.2.2
  • 5.x5.0.0 – 5.2.2Fixed in 5.2.3

On 7.x, the newest line:

npm install ws@7.4.6
8.x

  1. Not affected

    8.0.0 – 8.22.0

    41 releases, latest

7.x

  1. Affected

    7.0.0 – 7.4.5

    18 releases

  2. Fixed

    7.4.6 – 7.5.13

    15 releases

6.x

  1. Affected

    6.0.0 – 6.2.1

    8 releases

  2. Fixed

    6.2.2 – 6.2.6

    5 releases

5.x

  1. Affected

    5.0.0 – 5.2.2

    6 releases

  2. Fixed

    5.2.3 – 5.2.7

    5 releases

184 stable releases of ws, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for ws. It is read in your browser and sent nowhere.

What happens

Impact

A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server.

Proof of concept

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}

Patches

The vulnerability was fixed in ws@7.4.6 (00c425e) and backported to ws@6.2.2 (78c676d) and ws@5.2.3 (76d47c1).

Workarounds

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

Credits

The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.