Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] (e55e510) and backported to [email protected] (22c2876), [email protected] (eeb76d3), and [email protected] (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🔴 Nodejs ws library, Denial of Service via Fragmentation, #CVE-2024-37890 (High) -DC-Jun2026-396 https://dailycve.com/nodejs-ws-library-denial-of-service-via-fragmentation-cve-2024-37890-high-dc-jun2026-396/
Post summary
The post announces a new CVE-2024-37890 vulnerability in the Nodejs ws library that causes a denial‑of‑service via fragmentation, with no PoC, exploit, or patch details provided.
🟠 Nodejs ws, Uninitialized Memory Disclosure, #CVE-2024-37890 (medium) https://dailycve.com/nodejs-ws-uninitialized-memory-disclosure-cve-2024-37890-medium/
Post summary
The post announces a medium‑severity CVE‑2024‑37890 for NodeJS ws, noting an uninitialized memory disclosure, but offers no PoC, exploit, or patch details.