### [CVE-2021-32640](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32640)
![](https://img.shields.io/static/v1?label=Product&message=ws&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%205.0.0%20%3C%3D%207.4.5%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen)

### Description

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.

### POC

#### Reference
- https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff
- https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/PalindromeLabs/awesome-websocket-security
- https://github.com/anthonykirby/lora-packet
- https://github.com/engn33r/awesome-redos-security
- https://github.com/keymandll/dtrack.rs
- https://github.com/luiz-meireles/Redes-EP4