CVE-2024-37890 — NULL Pointer Dereference in Node-ws

CWE-476 — NULL Pointer DereferenceCWE-770 — Allocation of Resources Without Limits or Throttling17 documents6 sources
Severity
7.5HIGHNVD
OSV4.7
EPSS
0.5%
top 32.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
Linux KernelDebian Node-wsWS Project WS+7 more
Timeline
PublishedJun 17
Latest updateAug 4

Description

ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] (e55e510) and backported to [email protected] (22c2876), [email protected] (eeb76d3), and [email protected] (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or th…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages10 packages

▶debiandebian/node-ws< node-ws 8.18.0+~cs13.7.11-1 (forky)
▶CVEListV5websockets/ws4 versions+3
▶npmws_project/ws2.1.0 — 5.2.4+3
▶Ubuntulinux/linux_kernel< 5.15.0-143.153+1

🔴Vulnerability Details

13
OSV
linux-iot vulnerabilities↗2025-08-04
▶
OSV
linux-azure vulnerabilities↗2025-07-30
▶
OSV
linux-azure, linux-azure-5.4, linux-azure-fips, linux-raspi, linux-raspi-5.4 vulnerabilities↗2025-07-29
▶
OSV
linux, linux-aws, linux-aws-5.4, linux-aws-fips, linux-bluefield, linux-fips, linux-gcp, linux-gcp-5.4, linux-gcp-fips, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5↗2025-07-25
▶
OSV
linux-xilinx-zynqmp vulnerabilities↗2025-07-11
▶

📋Vendor Advisories

3
Red Hat
nodejs-ws: denial of service when handling a request with many HTTP headers↗2024-06-16
▶
Microsoft
Denial of service when handling a request with many HTTP headers in ws↗2024-06-11
▶
Debian
CVE-2024-37890: node-ws - ws is an open source WebSocket client and server for Node.js. A request with a n...↗2024
▶