CVE-2024-37890
1 advisory.
npm/ws CVE-2024-37890: high 7.5, EPSS 1.36%
ws affected by a DoS when handling a request with many HTTP headers
Action: Upgrade ws to 5.2.4 or later.
npm i ws@5.2.4npm i ws@6.2.3npm i ws@7.5.10npm i ws@8.17.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.1.0 | 5.2.4 | - |
| 6.0.0 | 6.2.3 | - |
| 7.0.0 | 7.5.10 | - |
| 8.0.0 | 8.17.1 | - |
Fixed versions
| 5.2.4 | 6.2.3 | 7.5.10 | 8.17.1 |
Sources
- osv: GHSA-3h5v-q93c-6h6q
- https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
- https://github.com/websockets/ws/issues/2230
- https://github.com/websockets/ws/pull/2231
- https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
- https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
- https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
- https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
- https://github.com/websockets/ws
CVE-2024-37890 · published · modified · JSON