CVE-2021-32640

MEDIUM5.3EPSS 1.2%

ReDoS in Sec-Websocket-Protocol header

發布日:2021/5/28修改日:2026/3/13
也稱為:GHSA-6fc8-4gx4-v693

描述

### Impact A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. ### Proof of concept ```js for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) { const value = 'b' + ' '.repeat(length) + 'x'; const start = process.hrtime.bigint(); value.trim().split(/ *, */); const end = process.hrtime.bigint(); console.log('length = %d, time = %f ns', length, end - start); } ``` ### Patches The vulnerability was fixed in [email protected] (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff) and backported to [email protected] (https://github.com/websockets/ws/commit/78c676d2a1acefbc05292e9f7ea0a9457704bf1b) and [email protected] (https://github.com/websockets/ws/commit/76d47c1479002022a3e4357b3c9f0e23a68d4cd2). ### Workarounds In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options. ### Credits The vulnerability was responsibly disclosed along with a fix in private by [Robert McLaughlin](https://github.com/robmcl4) from University of California, Santa Barbara.

受影響套件(2)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1MEDIUM5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

參考連結(8)