TI-2021-12308 Aliases CVE-2021-32640 GHSA-6fc8-4gx4-v693

ReDoS in Sec-Websocket-Protocol header

LOW 29CWE-400Published 2021-05-25 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service, Security bypass
Confidentiality · integrity · availability: None · None · Low
Fix status: Partial Red Hat: 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400 and CWE-345.

Summary

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in [email protected] (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.

Why it matters now

EPSS 0.02821 86th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial ws (npm): 7.4.6, 6.2.2, 5.2.3Red Hat: 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
websockets	ws	>= 5.0.0 <= 7.4.5	—	No fix listed	CNA
—	ws (npm)	7.0.0 to before 7.4.6	7.4.6	Patch available	GHSA-6fc8-4gx4-v693
—	ws (npm)	6.0.0 to before 6.2.2	6.2.2	Patch available	GHSA-6fc8-4gx4-v693
—	ws (npm)	5.0.0 to before 5.2.3	5.2.3	Patch available	GHSA-6fc8-4gx4-v693

ws Vendorwebsockets Affected >= 5.0.0 <= 7.4.5 Fixed in — No fix listed CNA
ws (npm) Vendor— Affected 7.0.0 to before 7.4.6 Fixed in 7.4.6 Patch available GHSA-6fc8-4gx4-v693
ws (npm) Vendor— Affected 6.0.0 to before 6.2.2 Fixed in 6.2.2 Patch available GHSA-6fc8-4gx4-v693
ws (npm) Vendor— Affected 5.0.0 to before 5.2.3 Fixed in 5.2.3 Patch available GHSA-6fc8-4gx4-v693

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:ws_project:ws::::::node.js::*	5.0.0 to before 6.2.2; 7.0.0 to before 7.4.6	Vulnerable	websockets
cpe:2.3:a:netapp:e-series_performance_analyzer:-:::::::*	not specified by NVD	Vulnerable	NetApp

cpe:2.3:a:ws_project:ws:*:*:*:*:*:node.js:*:* Versions 5.0.0 to before 6.2.2; 7.0.0 to before 7.4.6 Vulnerable ·websockets
cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

Fix · GHSA-6fc8-4gx4-v693 ws (npm) Fixed in 7.4.6 Advisory →
Fix · GHSA-6fc8-4gx4-v693 ws (npm) Fixed in 6.2.2 Advisory →
Fix · GHSA-6fc8-4gx4-v693 ws (npm) Fixed in 5.2.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Service Mesh 2.0	Affected	No fix yet
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix yet: Fix deferred
Red Hat Ansible Automation Platform 1.2	Affected	No fix yet
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat Openshift Container Storage 4	Affected	No fix yet

Timeline

2026-10-02 Threatist record created from CVE-2021-32640
2026-10-03 Alias added: GHSA-6fc8-4gx4-v693

References

Exploit 1

https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693

Patch 1

https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff

Advisory 2

Other 5

TI-2026-36049 ws: Memory exhaustion DoS from tiny fragments and data chunks CVSS 3.1HIGH 7.5
TI-2026-33473 ws: Uninitialized memory disclosure CVSS 3.1HIGH 7.5
TI-2016-08584 Uncontrolled resource consumption in HackerOne ws node module CVSS 3.0HIGH 7.5
TI-2016-08560 Memory corruption in HackerOne ws node module CVSS 3.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences