CVE-2021-32640

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.

• CWE-400
• CWE-400

• https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ffPatch, Third Party Advisory
• https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693Exploit, Mitigation, Patch, Third Party Advisory
• https://lists.apache.org/thread.html/rdfa7b6253c4d6271e31566ecd5f30b7ce1b8fb2c89d52b8c4e0f4e30%40%3Ccommits.tinkerpop.apache.org%3E
• https://security.netapp.com/advisory/ntap-20210706-0005/Third Party Advisory
• https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ffPatch, Third Party Advisory
• https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693Exploit, Mitigation, Patch, Third Party Advisory
• https://lists.apache.org/thread.html/rdfa7b6253c4d6271e31566ecd5f30b7ce1b8fb2c89d52b8c4e0f4e30%40%3Ccommits.tinkerpop.apache.org%3E
• https://security.netapp.com/advisory/ntap-20210706-0005/Third Party Advisory

Published

May 25, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32634Emissary is a distributed, peer-to-peer, data-driven workflo…7.2
• CVE-2021-32635Singularity is an open source container platform. In verions…6.3
• CVE-2021-32637Authelia is a a single sign-on multi-factor portal for web a…10
• CVE-2021-32638Github's CodeQL action is provided to run CodeQL-based code …4.4
• CVE-2021-32639Emissary is a P2P-based, data-driven workflow engine. Emissa…9.9
• CVE-2021-3264SQL Injection vulnerability in cxuucms 3.1 ivia the pid para…7.2
• CVE-2021-32641auth0-lock is Auth0's signin solution. Versions of nauth0-lo…6.1
• CVE-2021-32642radsecproxy is a generic RADIUS proxy that supports both UDP…9.4
• CVE-2021-32643Http4s is a Scala interface for HTTP services. `StaticFile.f…5.8
• CVE-2021-32644Ampache is an open source web based audio/video streaming ap…5.4
• CVE-2021-32645Tenancy multi-tenant is an open source multi-domain controll…6.1
• CVE-2021-32646Roomer is a discord bot cog (extension) which provides autom…7.3