CVE-2024-37890

ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.

• CWE-476

• https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
• https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
• https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
• https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
• https://github.com/websockets/ws/issues/2230
• https://github.com/websockets/ws/pull/2231
• https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
• https://nodejs.org/api/http.html#servermaxheaderscount
• https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
• https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
• https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
• https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
• https://github.com/websockets/ws/issues/2230
• https://github.com/websockets/ws/pull/2231
• https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
• https://nodejs.org/api/http.html#servermaxheaderscount

Published

Jun 17, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37885The Nextcloud Desktop Client is a tool to synchronize files …7.8
• CVE-2024-37886user_oidc app is an OpenID Connect user backend for Nextclou…4.7
• CVE-2024-37887Nextcloud Server is a self hosted personal cloud system. Pri…3.5
• CVE-2024-37888The Open Link is a CKEditor plugin, extending context menu w…6.1
• CVE-2024-37889MyFinances is a web application for managing finances. MyFin…6.5
• CVE-2024-3789Uncontrolled resource consumption vulnerability in White Bea…6.5
• CVE-2024-37891 urllib3 is a user-friendly HTTP client library for Python. …6.5
• CVE-2024-37893Firefly III is a free and open source personal finance manag…5.9
• CVE-2024-37894Squid is a caching proxy for the Web supporting HTTP, HTTPS,…6.3
• CVE-2024-37895Lobe Chat is an open-source LLMs/AI chat framework. In affec…5.7
• CVE-2024-37896Gin-vue-admin is a backstage management system based on vue …8.8
• CVE-2024-37897SFTPGo is a full-featured and highly configurable SFTP, HTTP…5.4