ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws.1 (e55e510) and backported to ws.10 (22c2876), ws.3 (eeb76d3), and ws.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied. https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63 https://github.com/websockets/ws/issues/2230 https://github.com/websockets/ws/pull/2231 https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q https://nodejs.org/api/http.html#servermaxheaderscount
Created nodejs-ws tracking bugs for this issue: Affects: epel-all [bug 2292778]
This issue has been addressed in the following products: RHODF-4.16-RHEL-9 Via RHSA-2024:4591 https://access.redhat.com/errata/RHSA-2024:4591
This issue has been addressed in the following products: RHODF-4.16-RHEL-9 Via RHSA-2024:5547 https://access.redhat.com/errata/RHSA-2024:5547
This issue has been addressed in the following products: RHODF-4.16-RHEL-9 Via RHSA-2024:6755 https://access.redhat.com/errata/RHSA-2024:6755
This issue has been addressed in the following products: RHODF-4.15-RHEL-9 Via RHSA-2025:8544 https://access.redhat.com/errata/RHSA-2025:8544
This issue has been addressed in the following products: RHODF-4.14-RHEL-9 Via RHSA-2025:8551 https://access.redhat.com/errata/RHSA-2025:8551