Quick answers
- Is CVE-2021-32640 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-32640 being exploited in the wild.
- How severe is CVE-2021-32640?
- Low severity, with a CVSS score of 3.1, published 28 May 2021.
- Which products and versions are affected?
- ws (npm) SEMVER:introduced=7.0.0,fixed=7.4.6.
- Is there a fix for CVE-2021-32640?
- Yes. ws (npm): upgrade to 7.4.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-32640 attacked?
- It is attacked over the network.
- Am I affected by CVE-2021-32640?
- Check whether you run ws (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- ws (npm): upgrade to 7.4.6 or later
npm install ws@7.4.6
Technical details
The vulnerability is a regular expression denial-of-service (ReDoS) issue in the Sec-Websocket-Protocol header parsing logic. The vulnerable code uses an inefficient regex pattern (split by / *, */`) that exhibits catastrophic backtracking when processing specially crafted input containing a large number of spaces. An attacker can send a WebSocket upgrade request with a malicious Sec-Websocket-Protocol header value (e.g., 'b' followed by thousands of spaces and 'x') to trigger exponential regex matching time, causing denial of service. No authentication is required; the attack is reachable via the network at the initial connection stage. The vulnerability was fixed in ws 7.4.6, 6.2.2, and 5.2.3; mitigation can be applied by limiting request header size via maxHeaderSize options.
Affected products
- websockets ws 5.0.0 through 5.2.2, 6.0.0 through 6.2.1, 7.0.0 through 7.4.5
Identifiers
- CVE-2021-32640
- GHSA-6fc8-4gx4-v693
Timeline
- 2021-05-25: disclosed
- 2021-05-28: patched: Fixed in ws 7.4.6, 6.2.2, and 5.2.3