Executive brief
The ws WebSocket library contains a regular expression denial-of-service (ReDoS) vulnerability in its parsing of the Sec-Websocket-Protocol HTTP header. An attacker can craft a malicious header value that causes the server to consume excessive CPU resources, significantly slowing down or potentially halting the WebSocket server. This can lead to service unavailability for legitimate users.
Technical details
The vulnerability is a regular expression denial-of-service (ReDoS) issue in the Sec-Websocket-Protocol header parsing logic. The vulnerable code uses an inefficient regex pattern (split by / *, */`) that exhibits catastrophic backtracking when processing specially crafted input containing a large number of spaces. An attacker can send a WebSocket upgrade request with a malicious Sec-Websocket-Protocol header value (e.g., 'b' followed by thousands of spaces and 'x') to trigger exponential regex matching time, causing denial of service. No authentication is required; the attack is reachable via the network at the initial connection stage. The vulnerability was fixed in ws 7.4.6, 6.2.2, and 5.2.3; mitigation can be applied by limiting request header size via maxHeaderSize options.
Affected products
- websockets ws 5.0.0 through 5.2.2, 6.0.0 through 6.2.1, 7.0.0 through 7.4.5
Timeline
- 2021-05-25: disclosed
- 2021-05-28: patched: Fixed in ws 7.4.6, 6.2.2, and 5.2.3