Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-h7zx-ben4-tfhf
Vulnerability ID VCID-h7zx-ben4-tfhf
Aliases CVE-2024-37890
GHSA-3h5v-q93c-6h6q
Summary ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-476 NULL Pointer Dereference
CWE-770 Allocation of Resources Without Limits or Throttling
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-37890.json
epss 0.00541 https://api.first.org/data/v1/epss?cve=CVE-2024-37890
epss 0.00541 https://api.first.org/data/v1/epss?cve=CVE-2024-37890
epss 0.00541 https://api.first.org/data/v1/epss?cve=CVE-2024-37890
epss 0.00541 https://api.first.org/data/v1/epss?cve=CVE-2024-37890
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-3h5v-q93c-6h6q
cvssv3.1 7.5 https://github.com/websockets/ws
cvssv4 8.7 https://github.com/websockets/ws
generic_textual HIGH https://github.com/websockets/ws
cvssv3.1 7.5 https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
cvssv4 8.7 https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
generic_textual HIGH https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
ssvc Track https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
cvssv3.1 7.5 https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
cvssv4 8.7 https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
generic_textual HIGH https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
ssvc Track https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
cvssv3.1 7.5 https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
cvssv4 8.7 https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
generic_textual HIGH https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
ssvc Track https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
cvssv3.1 7.5 https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
cvssv4 8.7 https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
generic_textual HIGH https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
ssvc Track https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
cvssv3.1 7.5 https://github.com/websockets/ws/issues/2230
cvssv4 8.7 https://github.com/websockets/ws/issues/2230
generic_textual HIGH https://github.com/websockets/ws/issues/2230
ssvc Track https://github.com/websockets/ws/issues/2230
cvssv3.1 7.5 https://github.com/websockets/ws/pull/2231
cvssv4 8.7 https://github.com/websockets/ws/pull/2231
generic_textual HIGH https://github.com/websockets/ws/pull/2231
ssvc Track https://github.com/websockets/ws/pull/2231
cvssv3.1 7.5 https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
cvssv3.1_qr HIGH https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
cvssv4 8.7 https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
generic_textual HIGH https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
ssvc Track https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
cvssv3.1 7.5 https://nodejs.org/api/http.html#servermaxheaderscount
ssvc Track https://nodejs.org/api/http.html#servermaxheaderscount
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-37890.json
https://api.first.org/data/v1/epss?cve=CVE-2024-37890
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37890
https://github.com/websockets/ws
1074236 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1074236
2230 https://github.com/websockets/ws/issues/2230
2231 https://github.com/websockets/ws/pull/2231
2292777 https://bugzilla.redhat.com/show_bug.cgi?id=2292777
22c28763234aa75a7e1b76f5c01c181260d7917f https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
4abd8f6de4b0b65ef80b3ff081989479ed93377e https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
CVE-2024-37890 https://nvd.nist.gov/vuln/detail/CVE-2024-37890
e55e5106f10fcbaac37cfa89759e4cc0d073a52c https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
eeb76d313e2a00dd5247ca3597bba7877d064a63 https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
GHSA-3h5v-q93c-6h6q https://github.com/advisories/GHSA-3h5v-q93c-6h6q
GHSA-3h5v-q93c-6h6q https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
http.html#servermaxheaderscount https://nodejs.org/api/http.html#servermaxheaderscount
RHSA-2024:4591 https://access.redhat.com/errata/RHSA-2024:4591
RHSA-2024:5547 https://access.redhat.com/errata/RHSA-2024:5547
RHSA-2024:6755 https://access.redhat.com/errata/RHSA-2024:6755
RHSA-2025:8544 https://access.redhat.com/errata/RHSA-2025:8544
RHSA-2025:8551 https://access.redhat.com/errata/RHSA-2025:8551
RHSA-2026:3710 https://access.redhat.com/errata/RHSA-2026:3710
RHSA-2026:3712 https://access.redhat.com/errata/RHSA-2026:3712
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-37890.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/websockets/ws
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Found at https://github.com/websockets/ws
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Found at https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-06-18T13:25:45Z/ Found at https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Found at https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-06-18T13:25:45Z/ Found at https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Found at https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-06-18T13:25:45Z/ Found at https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Found at https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-06-18T13:25:45Z/ Found at https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/websockets/ws/issues/2230
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Found at https://github.com/websockets/ws/issues/2230
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-06-18T13:25:45Z/ Found at https://github.com/websockets/ws/issues/2230
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/websockets/ws/pull/2231
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Found at https://github.com/websockets/ws/pull/2231
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-06-18T13:25:45Z/ Found at https://github.com/websockets/ws/pull/2231
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Found at https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-06-18T13:25:45Z/ Found at https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nodejs.org/api/http.html#servermaxheaderscount
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-06-18T13:25:45Z/ Found at https://nodejs.org/api/http.html#servermaxheaderscount
Exploit Prediction Scoring System (EPSS)
Percentile 0.68079
EPSS Score 0.00541
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:36:09.174467+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2024/37xxx/CVE-2024-37890.json 38.6.0