# CVE-2021-32640: ws ReDoS vulnerability in Sec-Websocket-Protocol header parsing

Source: https://junglewise.ai/threats/cve-2021-32640-ws-redos-vulnerability-in-sec-websocket-protocol-header-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-05-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-32640 · Severity: low · CVSS 3.1 · Published 2021-05-28

The ws WebSocket library contains a regular expression denial-of-service (ReDoS) vulnerability in its parsing of the Sec-Websocket-Protocol HTTP header. An attacker can craft a malicious header value that causes the server to consume excessive CPU resources, significantly slowing down or potentially halting the WebSocket server. This can lead to service unavailability for legitimate users.

Technologies: [ws (npm)](https://junglewise.ai/threats/technologies/ws). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-32640 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-32640 being exploited in the wild.

**How severe is CVE-2021-32640?** Low severity, with a CVSS score of 3.1, published 28 May 2021.

**Which products and versions are affected?** ws (npm) SEMVER:introduced=7.0.0,fixed=7.4.6.

**Is there a fix for CVE-2021-32640?** Yes. ws (npm): upgrade to 7.4.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-32640 attacked?** It is attacked over the network.

**Am I affected by CVE-2021-32640?** Check whether you run ws (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ws (npm): upgrade to 7.4.6 or later

  ```sh
  npm install ws@7.4.6
  ```


## Technical details

The vulnerability is a regular expression denial-of-service (ReDoS) issue in the Sec-Websocket-Protocol header parsing logic. The vulnerable code uses an inefficient regex pattern (split by / *, */`) that exhibits catastrophic backtracking when processing specially crafted input containing a large number of spaces. An attacker can send a WebSocket upgrade request with a malicious Sec-Websocket-Protocol header value (e.g., 'b' followed by thousands of spaces and 'x') to trigger exponential regex matching time, causing denial of service. No authentication is required; the attack is reachable via the network at the initial connection stage. The vulnerability was fixed in ws 7.4.6, 6.2.2, and 5.2.3; mitigation can be applied by limiting request header size via maxHeaderSize options.

## Affected products

- websockets ws 5.0.0 through 5.2.2, 6.0.0 through 6.2.1, 7.0.0 through 7.4.5

## Identifiers

- CVE-2021-32640
- GHSA-6fc8-4gx4-v693

## Timeline

- 2021-05-25: disclosed
- 2021-05-28: patched: Fixed in ws 7.4.6, 6.2.2, and 5.2.3

## References

- [https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693](https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693)

## Related threats

- [websockets ws memory exhaustion DoS via small fragments](https://junglewise.ai/threats/cve-2026-48779-websockets-ws-memory-exhaustion-dos-via-small-fragments)
- [websockets ws uninitialized memory disclosure in websocket.close](https://junglewise.ai/threats/cve-2026-45736-websockets-ws-uninitialized-memory-disclosure-in-websocket-close)
- [ws WebSocket denial of service in Sec-WebSocket-Extensions parsing](https://junglewise.ai/threats/ws-websocket-denial-of-service-in-sec-websocket-extensions-parsing-199b7f5b)
- [ws excessive websocket payload denial of service](https://junglewise.ai/threats/cve-2016-10542-ws-excessive-websocket-payload-denial-of-service)
- [websockets ws remote memory disclosure via uninitialized buffers](https://junglewise.ai/threats/cve-2016-10518-websockets-ws-remote-memory-disclosure-via-uninitialized-buffers)