CVE-2021-32640: ReDoS in Sec-Websocket-Protocol header

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-05-25 · updated 2026-06-17
Weakness: CWE-400

Description

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.

Affected products

NetApp E-Series Performance Analyzer: all versions
websockets ws: from 5.0.0 before 6.2.2; from 7.0.0 before 7.4.6 — fixed in 6.2.2, 7.4.6
Npm Ws: from 7.0.0 before 7.4.6; from 6.0.0 before 6.2.2; from 5.0.0 before 5.2.3 — fixed in 7.4.6, 6.2.2, 5.2.3

How to fix

Upgrade to a fixed version: websockets ws 6.2.2, 7.4.6; Npm Ws 7.4.6, 6.2.2, 5.2.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-32640 or the next vulnerability affects your stack