Update dependency ws to v8 [SECURITY] by renovate[bot] · Pull Request #15 · Web-Dev-Collaborative/Lambda-Final-Backup

renovate · 2026-05-09T22:59:08Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
ws	`^1.0.1` → `^8.0.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

ReDoS in Sec-Websocket-Protocol header

CVE-2021-32640 / GHSA-6fc8-4gx4-v693

More information

Details

Impact

A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server.

Proof of concept

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}

Patches

The vulnerability was fixed in ws@7.4.6 (websockets/ws@00c425e) and backported to ws@6.2.2 (websockets/ws@78c676d) and ws@5.2.3 (websockets/ws@76d47c1).

Workarounds

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

Credits

The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

websockets/ws (ws)

`v8.21.0`

Compare Source

`v8.20.1`

Compare Source

Bug fixes

Fixed an uninitialized memory disclosure issue in websocket.close()
(c0327ec).

Providing a TypedArray (e.g. Float32Array) as the reason argument for
websocket.close(), rather than the supported string or Buffer types, caused
uninitialized memory to be disclosed to the remote peer.

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer(
  { port: 0, skipUTF8Validation: true },
  function () {
    const { port } = wss.address();
    const ws = new WebSocket(`ws://localhost:${port}`, {
      skipUTF8Validation: true
    });

    ws.on('close', function (code, reason) {
      deepStrictEqual(reason, Buffer.alloc(80));
    });
  }
);

wss.on('connection', function (ws) {
  ws.close(1000, new Float32Array(20));
});

The issue was privately reported by Nikita Skovoroda.

`v8.20.0`

Compare Source

Features

Added exports for the PerMessageDeflate class and utilities for the
Sec-WebSocket-Extensions and Sec-WebSocket-Protocol headers (d3503c1).

`v8.19.0`

Compare Source

Features

Added the closeTimeout option (#2308).

Bug fixes

Handled a forthcoming breaking change in Node.js core (1998485).

`v8.18.3`

Compare Source

Bug fixes

Fixed a spec violation where the Sec-WebSocket-Version header was not added
to the HTTP response if the client requested version was either invalid or
unacceptable (#2291).

`v8.18.2`

Compare Source

Bug fixes

Fixed an issue that, during message decompression when the maximum size was
exceeded, led to the emission of an inaccurate error and closure of the
connection with an improper close code (#2285).

`v8.18.1`

Compare Source

Bug fixes

The length of the UNIX domain socket paths in the tests has been shortened to
make them work when run via CITGM (021f7b8).

`v8.18.0`

Compare Source

Features

Added support for Blob (#2229).

`v8.17.1`

Compare Source

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding theserver.maxHeadersCount
threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');

const wss = new WebSocket.Server({ port: 0 }, function () {
  const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
  const headers = {};
  let count = 0;

  for (let i = 0; i < chars.length; i++) {
    if (count === 2000) break;

    for (let j = 0; j < chars.length; j++) {
      const key = chars[i] + chars[j];
      headers[key] = 'x';

      if (++count === 2000) break;
    }
  }

  headers.Connection = 'Upgrade';
  headers.Upgrade = 'websocket';
  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
  headers['Sec-WebSocket-Version'] = '13';

  const request = http.request({
    headers: headers,
    host: '127.0.0.1',
    port: wss.address().port
  });

  request.end();
});

The vulnerability was reported by Ryan LaPointe in #2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

Reduce the maximum allowed length of the request headers using the
--max-http-header-size=size and/or the maxHeaderSize options so
that no more headers than the server.maxHeadersCount limit can be sent.
Set server.maxHeadersCount to 0 so that no limit is applied.

`v8.17.0`

Compare Source

Features

The WebSocket constructor now accepts the createConnection option (#2219).

Other notable changes

The default value of the allowSynchronousEvents option has been changed to
true (#2221).

This is a breaking change in a patch release. The assumption is that the option
is not widely used.

`v8.16.0`

Compare Source

Features

Added the autoPong option (01ba54e).

`v8.15.1`

Compare Source

Notable changes

The allowMultipleEventsPerMicrotask option has been renamed to
allowSynchronousEvents (4ed7fe5).

This is a breaking change in a patch release that could have been avoided with
an alias, but the renamed option was added only 3 days ago, so hopefully it
hasn't already been widely used.

`v8.15.0`

Compare Source

Features

Added the allowMultipleEventsPerMicrotask option (93e3552).

`v8.14.2`

Compare Source

Bug fixes

Fixed an issue that allowed errors thrown by failed assertions to be
swallowed when running tests (7f4e1a7).

`v8.14.1`

Compare Source

Bug fixes

Improved the reliability of two tests for CITGM (fd3c64c).

`v8.14.0`

Compare Source

Features

The WebSocket constructor now accepts HTTP(S) URLs (#2162).
The socket argument of server.handleUpgrade() can now be a generic
Duplex stream (#2165).

Other notable changes

At most one event per microtask is now emitted (#2160).

`v8.13.0`

Compare Source

Features

Added the finishRequest option to support late addition of headers (#2123).

`v8.12.1`

Compare Source

Bug fixes

Added browser condition to package.json (#2118).

`v8.12.0`

Compare Source

Features

Added support for utf-8-validate@6 (ff63bba).

Other notable changes

buffer.isUtf8() is now used instead of utf-8-validate if available
(42d79f6).

`v8.11.0`

Compare Source

Features

WebSocket.prototype.addEventListener() now supports an event listener
specified as an object with a handleEvent() method. (9ab743a).

Bug fixes

WebSocket.prototype.addEventListener() now adds an event listener only if it
is not already in the list of the event listeners for the specified event type
(1cec17d).

`v8.10.0`

Compare Source

Features

Added an export for package.json (211d5d3).

`v8.9.0`

Compare Source

Features

Added the ability to connect to Windows named pipes (#2079).

`v8.8.1`

Compare Source

Bug fixes

The Authorization and Cookie headers are no longer sent if the original
request for the opening handshake is sent to an IPC server and the client is
redirected to another IPC server (bc8bd34).

`v8.8.0`

Compare Source

Features

Added the WS_NO_BUFFER_UTIL and WS_NO_UTF_8_VALIDATE environment
variables (becf237).

`v8.7.0`

Compare Source

Features

Added the ability to inspect the invalid handshake requests and respond to
them with a custom HTTP response. (6e5a5ce).

Bug fixes

The handshake is now aborted if the Upgrade header field value in the HTTP
response is not a case-insensitive match for the value "websocket" (0fdcc0a).
The Authorization and Cookie headers are no longer sent when following an
insecure redirect (wss: to ws:) to the same host (d68ba9e).

`v8.6.0`

Compare Source

Features

Added the ability to remove confidential headers on a per-redirect basis (#2030).

`v8.5.0`

Compare Source

Features

Added the ability to use a custom WebSocket class on the server (#2007).

Bug fixes

When following redirects, the Authorization and Cookie headers are no
longer sent if the redirect host is different from the original host (#2013).

`v8.4.2`

Compare Source

Bug fixes

Fixed a data framing issue introduced in version 8.4.1 (#2004).

`v8.4.1`

Compare Source

Notable changes

To improve performance, strings sent via websocket.ping(),
websocket.pong(), and websocket.send() are no longer converted to
Buffers if the data does not need to be masked (#2000).

`v8.4.0`

Compare Source

Features

Added ability to generate custom masking keys (#1990).

`v8.3.0`

Compare Source

Features

Added ability to pause and resume a WebSocket (0a8c7a9).

Bug fixes

Fixed a bug that could prevent the connection from being closed cleanly when
using the stream API (ed2b803).
When following redirects, an error is now emitted and not thrown if the
redirect URL is invalid (#1980).

`v8.2.3`

Compare Source

Bug fixes

When context takeover is enabled, messages are now compressed even if their size
is below the value of the perMessageDeflate.threshold option (41ae563).

`v8.2.2`

Compare Source

Bug fixes

Some closing operations are now run only if needed (ec9377c).

`v8.2.1`

Compare Source

Bug fixes

Fixed an issue where the socket was not resumed, preventing the connection
from being closed cleanly (869c989).

`v8.2.0`

Compare Source

Features

Added WebSocket.WebSocket as an alias for WebSocket and
WebSocket.WebSocketServer as an alias for WebSocket.Server to fix name
consistency and improve interoperability with the ES module wrapper (#1935).

`v8.1.0`

Compare Source

Features

Added ability to skip UTF-8 validation (#1928).

Bug fixes

Fixed an issue with a breaking change in Node.js master (6a72da3).
Fixed a misleading error message (c95e695).

`v8.0.0`

Compare Source

Breaking changes

The WebSocket constructor now throws a SyntaxError if any of the
subprotocol names are invalid or duplicated (0aecf0c).
The server now aborts the opening handshake if an invalid
Sec-WebSocket-Protocol header field value is received (1877dde).
The protocols argument of handleProtocols hook is no longer an Array but
a Set (1877dde).
The opening handshake is now aborted if the Sec-WebSocket-Extensions header
field value is empty or it begins or ends with a white space (e814110).
Dropped support for Node.js < 10.0.0 (552b506).
The WebSocket constructor now throws a SyntaxError if the connection URL
contains a fragment identifier or if the URL's protocol is not one of 'ws:',
'wss:', or 'ws+unix:' (ebea038).
Text messages and close reasons are no longer decoded to strings. They are
passed as Buffers to the listeners of their respective events. The listeners
of the 'message' event now take a boolean argument specifying whether or not
the message is binary (e173423).

Existing code can be migrated by decoding the buffer explicitly.
```
websocket.on('message', function message(data, isBinary) {
  const message = isBinary ? data : data.toString();
  // Continue as before.
});

websocket.on('close', function close(code, data) {
  const reason = data.toString();
  // Continue as before.
});
```
The package now uses an ES module wrapper (78adf5f).
WebSocketServer.prototype.close() no longer closes existing connections
(df7de57).

Existing code can be migrated by closing the connections manually.
```
websocketServer.close();
for (const ws of websocketServer.clients) {
  ws.terminate();
}
```
The callback of WebSocketServer.prototype.close() is now called with an
error if the server is already closed (abde9cf).
WebSocket.prototype.addEventListener() is now a noop if the type argument
is not one of 'close', 'error', 'message', or 'open' (9558ed1).
WebSocket.prototype.removeEventListener() now only removes listeners added
with WebSocket.prototype.addEventListener() and only one at time (ea95d9c).
The value of the onclose, onerror, onmessage, and onopen properties is
now null if the respective event handler is not set (6756cf5).
The OpenEvent class has been removed (21e6500).

Bug fixes

The event listeners added via handler properties are now independent from the
event listeners added with WebSocket.prototype.addEventListener()
(0b21c03).

`v7.5.11`

Compare Source

Bug fixes

Backported 2b2abd4 to the 7.x release line (e14c458).

`v7.5.10`

Compare Source

Bug fixes

Backported e55e510 to the 7.x release line (22c2876).

`v7.5.9`

Compare Source

Bug fixes

Backported bc8bd34 to the 7.x release line (0435e6e).

`v7.5.8`

Compare Source

Bug fixes

Backported 0fdcc0a to the 7.x release line (2758ed3).
Backported d68ba9e to the 7.x release line (dc1781b).

`v7.5.7`

Compare Source

Bug fixes

Backported 6946f5f to the 7.x release line (1f72e2e).

`v7.5.6`

Compare Source

Bug fixes

Backported b8186dd to the 7.x release line (73dec34).
Backported ed2b803 to the 7.x release line (22a26af).

`v7.5.5`

Compare Source

Bug fixes

Backported ec9377c to the 7.x release line (0e274ac).

`v7.5.4`

Compare Source

Bug fixes

Backported 6a72da3 to the 7.x release line (76087fb).
Backported 869c989 to the 7.x release line (2799793).

`v7.5.3`

Compare Source

Bug fixes

The WebSocketServer constructor now throws an error if more than one of the
noServer, server, and port options are specefied (66e58d2).
Fixed a bug where a 'close' event was emitted by a WebSocketServer before
the internal HTTP/S server was actually closed (5a58730).
Fixed a bug that allowed WebSocket connections to be established after
WebSocketServer.prototype.close() was called (772236a).

`v7.5.2`

Compare Source

Bug fixes

The opening handshake is now aborted if the client receives a
Sec-WebSocket-Extensions header but no extension was requested or if the
server indicates an extension not requested by the client (aca94c8).

`v7.5.1`

Compare Source

Bug fixes

Fixed an issue that prevented the connection from being closed properly if an
error occurred simultaneously on both peers (b434b9f).

`v7.5.0`

Compare Source

Features

Some errors now have a code property describing the specific type of error
that has occurred (#1901).

Bug fixes

A close frame is now sent to the remote peer if an error (such as a data
framing error) occurs (8806aa9).
The close code is now always 1006 if no close frame is received, even if the
connection is closed due to an error (8806aa9).

`v7.4.6`

Compare Source

Bug fixes

Fixed a ReDoS vulnerability (00c425e).

A specially crafted value of the Sec-Websocket-Protocol header could be used
to significantly slow down a ws server.

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}

The vulnerability was responsibly disclosed along with a fix in private by
Robert McLaughlin from University of California, Santa Barbara.

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum
allowed length of the request headers using the --max-http-header-size=size
and/or the maxHeaderSize options.

`v7.4.5`

Compare Source

Bug fixes

UTF-8 validation is now done even if utf-8-validate is not installed
(23ba6b2).
Fixed an edge case where websocket.close() and websocket.terminate() did
not close the connection (67e25ff).

`v7.4.4`

Compare Source

Bug fixes

Fixed a bug that could cause the process to crash when using the
permessage-deflate extension (9277437).

`v7.4.3`

Compare Source

Bug fixes

The deflate/inflate stream is now reset instead of reinitialized when context
takeover is disabled (#1840).

`v7.4.2`

Compare Source

Bug fixes

Silenced a deprecation warning (a2c0d44).

`v7.4.1`

Compare Source

Bug fixes

Added a workaround for a double 'error' event bug in Node.js < 13 which
caused an uncaught error during the WebSocket handshake (38d6ab3).

`v7.4.0`

Compare Source

Features

The callback of WebSocketServer.prototype.handleUpgrade() now takes the
client HTTP GET request as second argument (7d39f19).

Bug fixes

Read-only properties are now read-only (eabed8f).
The CONNECTING, OPEN, CLOSING, CLOSED, binaryType, bufferedAmount,
extensions, onclose, onerror, onmessage, onopen, protocol,
readyState, and url properties are now enumerable (2069e68).

`v7.3.1`

Compare Source

Bug fixes

Improved websocket.bufferedAmount accuracy (e1349c0, a162942).

`v7.3.0`

Compare Source

Features

WebSocket.prototype.addEventListener() now supports the once option (#1754).

`v7.2.5`

Compare Source

Bug fixes

Fixed compatibility with Node.js master (651d662).

`v7.2.3`

Compare Source

Bug fixes

WebSocket#{p{i,o}ng,close}() now thow an error if the data to send is too
large to fit in a control frame (e54f08d).

`v7.2.2`

Compare Source

Bug fixes

Fixed an issue where calling webSocketStream.end() could cause the process
to crash (9535702).
The connection is now closed if a non-masked frame is received on the server
or a masked frame is received on the client (#1681).
The status code 1014 is now allowed to be used (#1682).

`v7.2.1`

Compare Source

Bug fixes

Added bufferutil and utf-8-validate as peer dependencies (#1626).

`v7.2.0`

Compare Source

Features

Added ability to specify the readableObjectMode option when using
WebSocket.createWebSocketStream() (#1647).

`v7.1.2`

Compare Source

Bug fixes

Fixed a bug that caused compress jobs to never be marked as complete
(#1618).

`v7.1.1`

Compare Source

Bug fixes

An error is now thrown if the WebSocket server constructor is used
incorrectly (3641266).

`v7.1.0`

Compare Source

Features

Added utility to wrap a WebSocket in a Duplex stream (#1589).

Bug fixes

Reverted "[minor] Remove unneeded if statement" (dbacf58, #1591).

`v7.0.1`

Compare Source

Bug fixes

Added ability to disable sending the SNI extension (#1587).

`v7.0.0`

Compare Source

Breaking changes

Dropped support for Node.js 6 (1e6999b).
Dropped support for url.Url instances in the WebSocket constructor
(692d7b4).
The behavior of WebSocket#{p{i,o}ng,send}() has changed when the
readyState attribute is not OPEN (#1532)
- If the readyState attribute is CONNECTING, an exception is thrown.
- If the readyState attribute is CLOSING or CLOSED
  - The bufferedAmount attribute is increased by the length of the data
    argument in bytes.
  - If provided, the callback function is called with an error.
  - No exception is thrown even if the callback function is not provided.

`v6.2.4`

Compare Source

Bug fixes

Backported 2b2abd4 to the 6.x release line (a76e211).

`v6.2.3`

Compare Source

Bug fixes

Backported e55e510 to the 6.x release line (eeb76d3).

`v6.2.2`

Compare Source

Bug fixes

Backported 00c425e to the 6.x release line (78c676d).

`v6.2.1`

Compare Source

Bug fixes

Fixed a bug that, under certain circumstances, prevented the close timer from
being set (aa1dcd5).

`v6.2.0`

Compare Source

Features

Added ability to follow redirects (#1490).

Bug fixes

The opening handshake is now aborted if the Sec-WebSocket-Key header field
value is invalid (160af45).

`v6.1.4`

Compare Source

Bug fixes

Fixed an issue that caused the Host header to always include a port (#1510).

`v6.1.3`

Compare Source

Bug fixes

Fixed a bug that, under certain circumstances, prevented the close frame from
being parsed (#1494).

`v6.1.2`

Compare Source

Bug fixes

Restored compatibility with Node.js < 6.13.0 (26436e0).

`v6.1.1`

Compare Source

Bug fixes

Queued messages to send are now discarded if the permessage-deflate is enabled
and the socket closes prematurely (#1464, #1471).

`v6.1.0`

Compare Source

Features

The WebSocket server now emits a 'close' event when the server
closes (#1453).

`v6.0.0`

Compare Source

Breaking changes

Dropped support for Node.js 4 (d73885c).
Added a shim that throws an error when used if the package is bundled for the
browser (#1345).
Added a maxPayload option on the client. Defaults to 100 MiB (#1402).
Dropped support for the memLevel and level options. Use
zlibDeflateOptions instead. (80e2002).

`v5.2.5`

Compare Source

Bug fixes

Backported 2b2abd4 to the 5.x release line (bd8756a).

`v5.2.4`

Compare Source

Bug fixes

Backported e55e510 to the 5.x release line (4abd8f6).

`v5.2.3`

Compare Source

Bug fixes

Backported 00c425e to the 5.x release line (76d47c1).

`v5.2.2`

Compare Source

Bug fixes

Fixed a use after invalidation bug introduced in 6046a28 (8aba871).

`v5.2.1`

Compare Source

Bug fixes

Fixed a bug that could prevent buffered data from being processed under
certain circumstances (6046a28).

`v5.2.0`

Compare Source

Features

Added ability to specify custom headers when rejecting the handshake (#1379).

`v5.1.1`

Compare Source

Bug fixes

Fixed a regression introduced in 9e152f9 (#1347).

`v5.1.0`

Compare Source

Features

The address argument of the WebSocket constructor can now be a URL
instance (#1329).
The options argument of the WebSocket constructor now accepts any TLS
option that is also accepted by https.request() (#1332).

`v5.0.0`

Compare Source

Breaking changes

Dropped support for Node.js < 4.5.0 (#1313).
The connection is no longer closed if the server does not agree to any of
the client's requested subprotocols (#1312).
net.Socket errors are no longer re-emitted (a4050db).

Features

Read backpressure is now properly handled when permessage-deflate is enabled
(#1302).

`v4.1.0`

Compare Source

Features

Added WebSocketServer.prototype.address() (#1294).
Added zlib{Deflate,Inflate}Options options (#1306).

`v4.0.0`

Compare Source

Breaking changes

The close status code is now set to 1005 if the received close frame contains
no status code (a31b1f6).
Error messages and types have been updated (695c5ea).
The onerror event handler now receives an ErrorEvent instead of JavaScript
error (63e275e).
The third argument of WebSocket.prototype.ping() and
WebSocket.prototype.pong() is no longer a boolean but an optional callback
(30c9f71).
The non-standard protocolVersion and bytesReceived attributes have been
removed (30c9f71...ee9b5f3).
The extensions attribute is no longer an object but a string representing
the extensions selected by the server (fdec524).
The 'headers' event on the client has been renamed to 'upgrade'. Listeners
of this event now receive only the response argument (1c783c2).
The WebSocket.prototype.pause() and WebSocket.prototype.resume() methods
have been removed to prevent the user from interfering with the state of the
underlying net.Socket stream (a206e98).

`v3.3.3`

Compare Source

Bug fixes

net.Socket errors are no longer swallowed (beff620).
The status code and close reason are now always taken from the close frame if
received (beff620).

`v3.3.2`

Compare Source

Bug fixes

The parser of the Sec-WebSocket-Extensions header has been rewritten to make
it spec-compliant (#1240).

`v3.3.1`

Compare Source

Bug fixes

Fixed a DoS vulnerability (c4fe466).

A specially crafted value of the Sec-WebSocket-Extensions header that
used Object.prototype property names as extension or parameter names
could be used to make a ws server crash.

const WebSocket = require('ws');
const net = require('net');

const wss = new WebSocket.Server({ port: 3000 }, function () {
  const payload = 'constructor';  // or ',;constructor'

  const request = [
    'GET / HTTP/1.1',
    'Connection: Upgrade',
    'Sec-WebSocket-Key: test',
    'Sec-WebSocket-Version: 8',
    `Sec-WebSocket-Extensions: ${payload}`,
    'Upgrade: websocket',
    '\r\n'
  ].join('\r\n');

  const socket = net.connect(3000, function () {
    socket.resume();
    socket.write(request);
  });
});

The vulnerability has been privately reported by Nick Starke and
Ryan Knell of Sonatype Security Research and promptly fixed. Please
update now!

`v3.3.0`

Compare Source

Features

Added ecdhCurve option (#1228).

`v3.2.0`

Compare Source

Features

Added ability to specify the compression level (#1199).
Added ability to limit the number of concurrent calls to zlib (#1204).

`v3.1.0`

Compare Source

Features

Added ability to specify the handshake request timeout (#1177).

Bug fixes

Fixed an issue where CloseEvent#wasClean was incorrectly set to false for
close codes in the 3000-4999 range (#1146).

`v3.0.0`

Compare Source

Breaking changes

Removed the upgradeReq property (#1099).
Removed unnecessary events (#1100).
Removed the flags argument from the 'message', 'ping', and 'pong'
events (#1101).
The permessage-deflate extension is now disabled by default on the server
(#1107).

`v2.3.1`

Compare Source

Bug fixes

Fixed an issue that prevented WebSocket.prototype.close() from working
properly when called from a listener of the headers event (732aaf0).

`v2.3.0`

Compare Source

Features

All hooks have now access to the upgrade request (#1070).
The WebSocket client now emits a headers event (#1082).

`v2.2.3`

Compare Source

Notable changes

Added support for Node.js 4.1.0 - 4.4.7 (#1059).

Bug fixes

Fixed a bug that caused the options argument to be reassigned when
protocols was null (20bd7c7).

`v2.2.2`

Compare Source

Bug fixes

Fixed a linter issue that prevented tests from running on CITGM (#1050).

`v2.2.1`

Compare Source

Bug fixes

WebSocket.prototype.terminate() now closes the connection immediately even
if the other peer fails to work properly (#1033).

`v2.2.0`

Compare Source

Features

Added "fragments" as possible value for the binaryType attribute (#1018).

Bug fixes

A random masking key is now also used for zero-length frames (5edb460).

`v2.1.0`

Compare Source

Features

Added ability to specify URL path with UNIX domain socket URLs (060b275).

Bug fixes

Fixed a bug that could make the parser crash if an error was emitted
synchronously on the socket while parsing data ([6695bd4](https://redirect.github.com/websockets/ws/c

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/npm-ws-vulnerability branch from e65afa7 to 21ba204 Compare May 10, 2026 15:52

renovate Bot changed the title ~~Update dependency ws to v8 [SECURITY]~~ Update dependency ws to v7 [SECURITY] May 10, 2026

Update dependency ws to v8 [SECURITY]

243ce90

renovate Bot force-pushed the renovate/npm-ws-vulnerability branch from 21ba204 to 243ce90 Compare June 7, 2026 20:18

renovate Bot changed the title ~~Update dependency ws to v7 [SECURITY]~~ Update dependency ws to v8 [SECURITY] Jun 7, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency ws to v8 [SECURITY]#15

Update dependency ws to v8 [SECURITY]#15
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-ws-vulnerability

renovate Bot commented May 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ReDoS in Sec-Websocket-Protocol header

Details

Impact

Proof of concept

Patches

Workarounds

Credits

Severity

References

Release Notes

Bug fixes

Features

Features

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Features

Bug fixes

Features

Other notable changes

Features

Notable changes

Features

Bug fixes

Bug fixes

Features

Other notable changes

Features

Bug fixes

Features

Other notable changes

Features

Bug fixes

Features

Features

Bug fixes

Features

Features

Bug fixes

Features

Features

Bug fixes

Bug fixes

Notable changes

Features

Features

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Features

Features

Bug fixes

Breaking changes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Features

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Features

Bug fixes

renovate Bot commented May 9, 2026 •

edited

Loading