CVE-2024-37890
Fixed in a distro release EPSS 1%CVSS 7.5
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
Products: websockets ws
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | ws | 5.2.4 |
| npm | ws | 6.2.3 |
| npm | ws | 7.5.10 |
| npm | ws | 8.17.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | arangodb-3.11 | 3.11.14.4-r12 |
| Chainguard | arangodb-3.12 | 3.12.9.4-r7 |
| Chainguard | argo-workflow-cli | 3.6.5-r2 |
| Chainguard | argo-workflow-controller | 3.6.5-r2 |
| Chainguard | argo-workflow-controller-compat | 3.6.5-r2 |
| Chainguard | argo-workflow-executor | 3.6.5-r2 |
| Chainguard | argo-workflow-executor-compat | 3.6.5-r2 |
| Chainguard | argo-workflows | 3.6.5-r2 |
| Chainguard | argo-workflows-known-hosts | 3.6.5-r2 |
| Chainguard | argo-workflows-ui | 3.6.5-r2 |
| Chainguard | gemini-cli | 0.49.0-r4 |
| Chainguard | kibana-7 | 7.17.24-r0 |
| Chainguard | kibana-7-bitnami | 7.17.24-r0 |
| Chainguard | kibana-7.17 | 7.17.29-r0 |
| Chainguard | kibana-8 | 8.17.3-r2 |
| Chainguard | kibana-8-bitnami | 8.17.3-r2 |
| Chainguard | kibana-8-iamguarded | 8.17.3-r2 |
| Chainguard | kubeflow-centraldashboard | 1.8.0-r5 |
| Chainguard | kubeflow-pipelines | 2.2.0-r4 |
| Chainguard | kubeflow-pipelines-apiserver | 2.2.0-r4 |
| Chainguard | kubeflow-pipelines-cache-deployer | 2.2.0-r4 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 2.2.0-r4 |
| Chainguard | kubeflow-pipelines-cache_server | 2.2.0-r4 |
| Chainguard | kubeflow-pipelines-frontend | 2.2.0-r4 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 2.2.0-r4 |
| Chainguard | kubeflow-pipelines-metadata-writer | 2.2.0-r4 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 2.2.0-r4 |
| Chainguard | kubeflow-pipelines-persistence_agent | 2.2.0-r4 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 2.2.0-r4 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 2.2.0-r4 |
| Chainguard | opensearch-dashboards-2 | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-alerting-dashboards-plugin | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-config | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-maps | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-notifications | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-observability | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-query-workbench | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-reporting | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-search-relevance | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-dashboards-visualizations | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-fips | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-fips-alerting-dashboards-plugin | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-fips-config | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-maps | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-notifications | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-observability | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-query-workbench | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-reporting | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-search-relevance | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-visualizations | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-fips-index-management-dashboards-plugin | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-fips-ml-commons-dashboards | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-fips-security-analytics-dashboards-plugin | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-fips-security-dashboards-plugin | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-index-management-dashboards-plugin | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-ml-commons-dashboards | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-security-analytics-dashboards-plugin | 2.15.0-r1 |
| Chainguard | opensearch-dashboards-2-security-dashboards-plugin | 2.15.0-r1 |
| Debian 12 | node-ws | no fix |
| Debian 13 | node-ws | 8.18.0+~cs13.7.11-1 |
| Debian 14 | node-ws | 8.18.0+~cs13.7.11-1 |
| Red Hat Enterprise Linux 10.0 | aspnetcore-runtime-8.0 | 0:8.0.13-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | aspnetcore-runtime-dbg-8.0 | 0:8.0.13-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | aspnetcore-targeting-pack-8.0 | 0:8.0.13-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | dotnet-apphost-pack-8.0 | 0:8.0.13-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | dotnet-apphost-pack-8.0-debuginfo | 0:8.0.13-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | dotnet-hostfxr-8.0 | 0:8.0.13-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | dotnet-hostfxr-8.0-debuginfo | 0:8.0.13-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | dotnet-runtime-8.0 | 0:8.0.13-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | dotnet-runtime-8.0-debuginfo | 0:8.0.13-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | dotnet-runtime-dbg-8.0 | 0:8.0.13-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | dotnet-sdk-8.0 | 0:8.0.113-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | dotnet-sdk-8.0-debuginfo | 0:8.0.113-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | dotnet-sdk-8.0-source-built-artifacts | 0:8.0.113-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | dotnet-sdk-dbg-8.0 | 0:8.0.113-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | dotnet-targeting-pack-8.0 | 0:8.0.13-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | dotnet-templates-8.0 | 0:8.0.113-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | dotnet8.0 | 0:8.0.113-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | dotnet8.0-debugsource | 0:8.0.113-2.el10_0 |
| Red Hat Enterprise Linux 9 | aspnetcore-runtime-6.0 | 0:6.0.35-2.el9_5 |
| Red Hat Enterprise Linux 9 | aspnetcore-runtime-8.0 | 0:8.0.10-3.el9_5 |
| Red Hat Enterprise Linux 9 | aspnetcore-runtime-dbg-8.0 | 0:8.0.10-3.el9_5 |
| Red Hat Enterprise Linux 9 | aspnetcore-targeting-pack-6.0 | 0:6.0.35-2.el9_5 |
| Red Hat Enterprise Linux 9 | aspnetcore-targeting-pack-8.0 | 0:8.0.10-3.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-apphost-pack-6.0 | 0:6.0.35-2.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-apphost-pack-6.0-debuginfo | 0:6.0.35-2.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-apphost-pack-8.0 | 0:8.0.10-3.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-apphost-pack-8.0-debuginfo | 0:8.0.10-3.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-hostfxr-6.0 | 0:6.0.35-2.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-hostfxr-6.0-debuginfo | 0:6.0.35-2.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-hostfxr-8.0 | 0:8.0.10-3.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-hostfxr-8.0-debuginfo | 0:8.0.10-3.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-runtime-6.0 | 0:6.0.35-2.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-runtime-6.0-debuginfo | 0:6.0.35-2.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-runtime-8.0 | 0:8.0.10-3.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-runtime-8.0-debuginfo | 0:8.0.10-3.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-runtime-dbg-8.0 | 0:8.0.10-3.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-sdk-6.0 | 0:6.0.135-2.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-sdk-6.0-debuginfo | 0:6.0.135-2.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-sdk-6.0-source-built-artifacts | 0:6.0.135-2.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-sdk-8.0 | 0:8.0.110-3.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-sdk-8.0-debuginfo | 0:8.0.110-3.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-sdk-8.0-source-built-artifacts | 0:8.0.110-3.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-sdk-dbg-8.0 | 0:8.0.110-3.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-targeting-pack-6.0 | 0:6.0.35-2.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-targeting-pack-8.0 | 0:8.0.10-3.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-templates-6.0 | 0:6.0.135-2.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet-templates-8.0 | 0:8.0.110-3.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet6.0 | 0:6.0.135-2.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet6.0-debuginfo | 0:6.0.135-2.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet6.0-debugsource | 0:6.0.135-2.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet8.0 | 0:8.0.110-3.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet8.0-debuginfo | 0:8.0.110-3.el9_5 |
| Red Hat Enterprise Linux 9 | dotnet8.0-debugsource | 0:8.0.110-3.el9_5 |
| Ubuntu 16.04 LTS | node-ws | no fix |
| Ubuntu 18.04 LTS | node-ws | no fix |
| Ubuntu 20.04 LTS | node-ws | no fix |
| Ubuntu 22.04 LTS | node-ws | no fix |
| Ubuntu 24.04 LTS | node-ws | no fix |
| Ubuntu 25.10 | node-ws | no fix |
| Ubuntu 26.04 LTS | node-ws | no fix |
| Ubuntu 26.10 | node-ws | no fix |
| Wolfi | argo-workflow-cli | 3.6.5-r2 |
| Wolfi | argo-workflow-controller | 3.6.5-r2 |
| Wolfi | argo-workflow-controller-compat | 3.6.5-r2 |
| Wolfi | argo-workflow-executor | 3.6.5-r2 |
| Wolfi | argo-workflow-executor-compat | 3.6.5-r2 |
| Wolfi | argo-workflows | 3.6.5-r2 |
| Wolfi | argo-workflows-known-hosts | 3.6.5-r2 |
| Wolfi | argo-workflows-ui | 3.6.5-r2 |
| Wolfi | kubeflow-centraldashboard | 1.8.0-r5 |
| Wolfi | kubeflow-pipelines | 2.2.0-r4 |
| Wolfi | kubeflow-pipelines-apiserver | 2.2.0-r4 |
| Wolfi | kubeflow-pipelines-cache-deployer | 2.2.0-r4 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 2.2.0-r4 |
| Wolfi | kubeflow-pipelines-cache_server | 2.2.0-r4 |
| Wolfi | kubeflow-pipelines-frontend | 2.2.0-r4 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 2.2.0-r4 |
| Wolfi | kubeflow-pipelines-metadata-writer | 2.2.0-r4 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 2.2.0-r4 |
| Wolfi | kubeflow-pipelines-persistence_agent | 2.2.0-r4 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 2.2.0-r4 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 2.2.0-r4 |
| Wolfi | opensearch-dashboards-2 | 2.15.0-r1 |
| Wolfi | opensearch-dashboards-2-alerting-dashboards-plugin | 2.15.0-r1 |
| Wolfi | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 2.15.0-r1 |
| Wolfi | opensearch-dashboards-2-config | 2.15.0-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-maps | 2.15.0-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-notifications | 2.15.0-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-observability | 2.15.0-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-query-workbench | 2.15.0-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-reporting | 2.15.0-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-search-relevance | 2.15.0-r1 |
| Wolfi | opensearch-dashboards-2-dashboards-visualizations | 2.15.0-r1 |
| Wolfi | opensearch-dashboards-2-index-management-dashboards-plugin | 2.15.0-r1 |
| Wolfi | opensearch-dashboards-2-ml-commons-dashboards | 2.15.0-r1 |
| Wolfi | opensearch-dashboards-2-security-analytics-dashboards-plugin | 2.15.0-r1 |
| Wolfi | opensearch-dashboards-2-security-dashboards-plugin | 2.15.0-r1 |