Update dependency ws to v7 [SECURITY] by renovate[bot] · Pull Request #15 · Web-Dev-Collaborative/Lambda-Final-Backup

renovate · 2026-05-09T22:59:08Z

This PR contains the following updates:

Package	Change	Age	Confidence
ws	`^1.0.1` → `^7.4.6`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

ReDoS in Sec-Websocket-Protocol header

CVE-2021-32640 / GHSA-6fc8-4gx4-v693

More information

Details

Impact

A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server.

Proof of concept

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}

Patches

The vulnerability was fixed in ws@7.4.6 (websockets/ws@00c425e) and backported to ws@6.2.2 (websockets/ws@78c676d) and ws@5.2.3 (websockets/ws@76d47c1).

Workarounds

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

Credits

The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

websockets/ws (ws)

`v7.4.6`

Compare Source

Bug fixes

Fixed a ReDoS vulnerability (00c425e).

A specially crafted value of the Sec-Websocket-Protocol header could be used
to significantly slow down a ws server.

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}

The vulnerability was responsibly disclosed along with a fix in private by
Robert McLaughlin from University of California, Santa Barbara.

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum
allowed length of the request headers using the --max-http-header-size=size
and/or the maxHeaderSize options.

`v7.4.5`

Compare Source

Bug fixes

UTF-8 validation is now done even if utf-8-validate is not installed
(23ba6b2).
Fixed an edge case where websocket.close() and websocket.terminate() did
not close the connection (67e25ff).

`v7.4.4`

Compare Source

Bug fixes

Fixed a bug that could cause the process to crash when using the
permessage-deflate extension (9277437).

`v7.4.3`

Compare Source

Bug fixes

The deflate/inflate stream is now reset instead of reinitialized when context
takeover is disabled (#1840).

`v7.4.2`

Compare Source

Bug fixes

Silenced a deprecation warning (a2c0d44).

`v7.4.1`

Compare Source

Bug fixes

Added a workaround for a double 'error' event bug in Node.js < 13 which
caused an uncaught error during the WebSocket handshake (38d6ab3).

`v7.4.0`

Compare Source

Features

The callback of WebSocketServer.prototype.handleUpgrade() now takes the
client HTTP GET request as second argument (7d39f19).

Bug fixes

Read-only properties are now read-only (eabed8f).
The CONNECTING, OPEN, CLOSING, CLOSED, binaryType, bufferedAmount,
extensions, onclose, onerror, onmessage, onopen, protocol,
readyState, and url properties are now enumerable (2069e68).

`v7.3.1`

Compare Source

Bug fixes

Improved websocket.bufferedAmount accuracy (e1349c0, a162942).

`v7.3.0`

Compare Source

Features

WebSocket.prototype.addEventListener() now supports the once option (#1754).

`v7.2.5`

Compare Source

Bug fixes

Fixed compatibility with Node.js master (651d662).

`v7.2.3`

Compare Source

Bug fixes

WebSocket#{p{i,o}ng,close}() now thow an error if the data to send is too
large to fit in a control frame (e54f08d).

`v7.2.2`

Compare Source

Bug fixes

Fixed an issue where calling webSocketStream.end() could cause the process
to crash (9535702).
The connection is now closed if a non-masked frame is received on the server
or a masked frame is received on the client (#1681).
The status code 1014 is now allowed to be used (#1682).

`v7.2.1`

Compare Source

Bug fixes

Added bufferutil and utf-8-validate as peer dependencies (#1626).

`v7.2.0`

Compare Source

Features

Added ability to specify the readableObjectMode option when using
WebSocket.createWebSocketStream() (#1647).

`v7.1.2`

Compare Source

Bug fixes

Fixed a bug that caused compress jobs to never be marked as complete
(#1618).

`v7.1.1`

Compare Source

Bug fixes

An error is now thrown if the WebSocket server constructor is used
incorrectly (3641266).

`v7.1.0`

Compare Source

Features

Added utility to wrap a WebSocket in a Duplex stream (#1589).

Bug fixes

Reverted "[minor] Remove unneeded if statement" (dbacf58, #1591).

`v7.0.1`

Compare Source

Bug fixes

Added ability to disable sending the SNI extension (#1587).

`v7.0.0`

Compare Source

Breaking changes

Dropped support for Node.js 6 (1e6999b).
Dropped support for url.Url instances in the WebSocket constructor
(692d7b4).
The behavior of WebSocket#{p{i,o}ng,send}() has changed when the
readyState attribute is not OPEN (#1532)
- If the readyState attribute is CONNECTING, an exception is thrown.
- If the readyState attribute is CLOSING or CLOSED
  - The bufferedAmount attribute is increased by the length of the data
    argument in bytes.
  - If provided, the callback function is called with an error.
  - No exception is thrown even if the callback function is not provided.

`v6.2.3`

Compare Source

Bug fixes

Backported e55e510 to the 6.x release line (eeb76d3).

`v6.2.2`

Compare Source

Bug fixes

Backported 00c425e to the 6.x release line (78c676d).

`v6.2.1`

Compare Source

Bug fixes

Fixed a bug that, under certain circumstances, prevented the close timer from
being set (aa1dcd5).

`v6.2.0`

Compare Source

Features

Added ability to follow redirects (#1490).

Bug fixes

The opening handshake is now aborted if the Sec-WebSocket-Key header field
value is invalid (160af45).

`v6.1.4`

Compare Source

Bug fixes

Fixed an issue that caused the Host header to always include a port (#1510).

`v6.1.3`

Compare Source

Bug fixes

Fixed a bug that, under certain circumstances, prevented the close frame from
being parsed (#1494).

`v6.1.2`

Compare Source

Bug fixes

Restored compatibility with Node.js < 6.13.0 (26436e0).

`v6.1.1`

Compare Source

Bug fixes

Queued messages to send are now discarded if the permessage-deflate is enabled
and the socket closes prematurely (#1464, #1471).

`v6.1.0`

Compare Source

Features

The WebSocket server now emits a 'close' event when the server
closes (#1453).

`v6.0.0`

Compare Source

Breaking changes

Dropped support for Node.js 4 (d73885c).
Added a shim that throws an error when used if the package is bundled for the
browser (#1345).
Added a maxPayload option on the client. Defaults to 100 MiB (#1402).
Dropped support for the memLevel and level options. Use
zlibDeflateOptions instead. (80e2002).

`v5.2.4`

Compare Source

Bug fixes

Backported e55e510 to the 5.x release line (4abd8f6).

`v5.2.3`

Compare Source

Bug fixes

Backported 00c425e to the 5.x release line (76d47c1).

`v5.2.2`

Compare Source

Bug fixes

Fixed a use after invalidation bug introduced in 6046a28 (8aba871).

`v5.2.1`

Compare Source

Bug fixes

Fixed a bug that could prevent buffered data from being processed under
certain circumstances (6046a28).

`v5.2.0`

Compare Source

Features

Added ability to specify custom headers when rejecting the handshake (#1379).

`v5.1.1`

Compare Source

Bug fixes

Fixed a regression introduced in 9e152f9 (#1347).

`v5.1.0`

Compare Source

Features

The address argument of the WebSocket constructor can now be a URL
instance (#1329).
The options argument of the WebSocket constructor now accepts any TLS
option that is also accepted by https.request() (#1332).

`v5.0.0`

Compare Source

Breaking changes

Dropped support for Node.js < 4.5.0 (#1313).
The connection is no longer closed if the server does not agree to any of
the client's requested subprotocols (#1312).
net.Socket errors are no longer re-emitted (a4050db).

Features

Read backpressure is now properly handled when permessage-deflate is enabled
(#1302).

`v4.1.0`

Compare Source

Features

Added WebSocketServer.prototype.address() (#1294).
Added zlib{Deflate,Inflate}Options options (#1306).

`v4.0.0`

Compare Source

Breaking changes

The close status code is now set to 1005 if the received close frame contains
no status code (a31b1f6).
Error messages and types have been updated (695c5ea).
The onerror event handler now receives an ErrorEvent instead of JavaScript
error (63e275e).
The third argument of WebSocket.prototype.ping() and
WebSocket.prototype.pong() is no longer a boolean but an optional callback
(30c9f71).
The non-standard protocolVersion and bytesReceived attributes have been
removed (30c9f71...ee9b5f3).
The extensions attribute is no longer an object but a string representing
the extensions selected by the server (fdec524).
The 'headers' event on the client has been renamed to 'upgrade'. Listeners
of this event now receive only the response argument (1c783c2).
The WebSocket.prototype.pause() and WebSocket.prototype.resume() methods
have been removed to prevent the user from interfering with the state of the
underlying net.Socket stream (a206e98).

`v3.3.3`

Compare Source

Bug fixes

net.Socket errors are no longer swallowed (beff620).
The status code and close reason are now always taken from the close frame if
received (beff620).

`v3.3.2`

Compare Source

Bug fixes

The parser of the Sec-WebSocket-Extensions header has been rewritten to make
it spec-compliant (#1240).

`v3.3.1`

Compare Source

Bug fixes

Fixed a DoS vulnerability (c4fe466).

A specially crafted value of the Sec-WebSocket-Extensions header that
used Object.prototype property names as extension or parameter names
could be used to make a ws server crash.

const WebSocket = require('ws');
const net = require('net');

const wss = new WebSocket.Server({ port: 3000 }, function () {
  const payload = 'constructor';  // or ',;constructor'

  const request = [
    'GET / HTTP/1.1',
    'Connection: Upgrade',
    'Sec-WebSocket-Key: test',
    'Sec-WebSocket-Version: 8',
    `Sec-WebSocket-Extensions: ${payload}`,
    'Upgrade: websocket',
    '\r\n'
  ].join('\r\n');

  const socket = net.connect(3000, function () {
    socket.resume();
    socket.write(request);
  });
});

The vulnerability has been privately reported by Nick Starke and
Ryan Knell of Sonatype Security Research and promptly fixed. Please
update now!

`v3.3.0`

Compare Source

Features

Added ecdhCurve option (#1228).

`v3.2.0`

Compare Source

Features

Added ability to specify the compression level (#1199).
Added ability to limit the number of concurrent calls to zlib (#1204).

`v3.1.0`

Compare Source

Features

Added ability to specify the handshake request timeout (#1177).

Bug fixes

Fixed an issue where CloseEvent#wasClean was incorrectly set to false for
close codes in the 3000-4999 range (#1146).

`v3.0.0`

Compare Source

Breaking changes

Removed the upgradeReq property (#1099).
Removed unnecessary events (#1100).
Removed the flags argument from the 'message', 'ping', and 'pong'
events (#1101).
The permessage-deflate extension is now disabled by default on the server
(#1107).

`v2.3.1`

Compare Source

Bug fixes

Fixed an issue that prevented WebSocket.prototype.close() from working
properly when called from a listener of the headers event (732aaf0).

`v2.3.0`

Compare Source

Features

All hooks have now access to the upgrade request (#1070).
The WebSocket client now emits a headers event (#1082).

`v2.2.3`

Compare Source

Notable changes

Added support for Node.js 4.1.0 - 4.4.7 (#1059).

Bug fixes

Fixed a bug that caused the options argument to be reassigned when
protocols was null (20bd7c7).

`v2.2.2`

Compare Source

Bug fixes

Fixed a linter issue that prevented tests from running on CITGM (#1050).

`v2.2.1`

Compare Source

Bug fixes

WebSocket.prototype.terminate() now closes the connection immediately even
if the other peer fails to work properly (#1033).

`v2.2.0`

Compare Source

Features

Added "fragments" as possible value for the binaryType attribute (#1018).

Bug fixes

A random masking key is now also used for zero-length frames (5edb460).

`v2.1.0`

Compare Source

Features

Added ability to specify URL path with UNIX domain socket URLs (060b275).

Bug fixes

Fixed a bug that could make the parser crash if an error was emitted
synchronously on the socket while parsing data (6695bd4).

`v2.0.3`

Compare Source

Bug fixes

Fixed an issue that caused a stack overflow when parsing a buffer with
thousands of frames (#992).
Restored support for default port numbers (f043b52).

`v2.0.2`

Compare Source

Notable changes

Added support for bufferutil@2 and utf-8-validate@3 (466e210).

`v2.0.1`

Compare Source

Bug fixes

Fixed a bug that caused wrong frames to be created (d856dcb).

`v2.0.0`

Compare Source

Breaking changes

Dropped support for Node.js < 4.5.0.
The new operator is now required to create all instances as we moved to ES6
classes.
Error messages have been simplified.
The clients property of the WebSocketServer is no longer an Array but a
Set and is only set if the clientTracking option is truthy (#806).
The default HTTP status message is now used when handshake fails (41e7cae).
Removed support for the Hixie-76 version of the protocol (#871).
Removed ability to specify different paths for multiple WebSocketServers
when binding them to the same underlying HTTP/s server (#885).
Removed WebSocket.prototype.stream() and ability to pass a readable stream
to WebSocket.prototype.send() (#875).
Removed callback argument from handleProtocols handler (#890).
Removed supports property from WebSocket (#918).
Removed WebSocket.createServer(), WebSocket.createConnection(), and
WebSocket.connect() factory functions (#926).
The second argument of WebSocket.prototype.ping() and
WebSocket.prototype.pong() is no longer an options object but a boolean
(#951).
An error is emitted if WebSocket.prototype.close() is called before the
connection is established (#956).

The following breaking changes only apply if you required the mentioned classes
directly.

Removed Sender inheritance from EventEmitter (#861).
Removed BufferPool class (73ab370).
Made extensions a required argument for the Receiver constructor (5f53194).
receiver.onbinary and receiver.ontext have been merged into
receiver.onmessage (#939).

Features

Added ability to set TCP backlog for WebSocketServer (#795).
Added checkServerIdentity option to WebSocket (#701).
Added a threshold option for permessage-deflate to only compress messages
whose size is bigger than threshold (6b3904b).
Added shouldHandle method to WebSocketServer to see if a request should
be accepted or rejected. This method can be overridden by the user if a
custom logic is desired (6472425).
Added removeEventListener method to WebSocket (078e96a).
Added family option to WebSocket (#962).

Bug fixes

Fixed an issue that prevented permessage-deflate options from being correctly
handled (#744).
All error events are now emitted with a proper Error instance (#789).
Fixed an issue that could cause a stack overflow crash (#810).
Added 1012 and 1013 to the list of allowed close codes (b58f688).
Fixed an issue that prevented the connection from being closed when path
validation failed (#534).
Fixed an issue where the fin option of WebSocket.prototype.send() was
unconditionally set to true (ea50be7).
Fixed an issue that prevented the total length of a fragmented message from
being correctly calculated (545635d).
Fixed an issue where zlib.flush() was called with a wrong flush level
(#733).
The callback of WebSocketServer.prototype.close() is now invoked when the
close event is emitted by the underlying HTTP/s server (#892).
Fixed an issue that prevented the server from listening on IPv6 addresses
with default settings (dcdc652).
Fixed an issue where the connection event was emitted even if the client
closed the connection during the handshake process (04530ad).
The masking key is now generated using crypto.randomBytes() instead of
Math.random() (7253f06).
Fixed an issue that, under particular circumstances, caused data to be
discarded (#945).
Fixed an issue that prevented clients from being removed from the clients
set (#955).
WebSocket.prototype.close() now works as expected if called on the client
before the connection is established (#956).
WebSocket.prototype.send() no longer mutates the options object (#968).
The bufferedAmount getter now takes into account the data queued in the
sender (#971).

`v1.1.5`

Compare Source

Bug fixes

Fixed a DoS vulnerability (f8fdcd4).

`v1.1.4`

Compare Source

Notable changes

Removed istanbul coverage folder from npm package (fac50ac).

`v1.1.3`

Compare Source

Notable changes

Added support for bufferutil@>1 and utf-8-validate@>2 (b4cf110).

`v1.1.2`

Compare Source

Bug fixes

The masking key is now generated using crypto.randomBytes() instead of
Math.random() (#994).
Fixed an issue that could cause a stack overflow crash (c1f3b21).

`v1.1.1`

Compare Source

`v1.1.0`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Update dependency ws to v7 [SECURITY]

21ba204

renovate Bot force-pushed the renovate/npm-ws-vulnerability branch from e65afa7 to 21ba204 Compare May 10, 2026 15:52

renovate Bot changed the title ~~Update dependency ws to v8 [SECURITY]~~ Update dependency ws to v7 [SECURITY] May 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency ws to v7 [SECURITY]#15

Update dependency ws to v7 [SECURITY]#15
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-ws-vulnerability

renovate Bot commented May 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ReDoS in Sec-Websocket-Protocol header

Details

Impact

Proof of concept

Patches

Workarounds

Credits

Severity

References

Release Notes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Features

Bug fixes

Bug fixes

Features

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Features

Bug fixes

Bug fixes

Features

Bug fixes

Bug fixes

Breaking changes

Bug fixes

Bug fixes

Bug fixes

Features

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Features

Breaking changes

Bug fixes

Bug fixes

Bug fixes

Bug fixes

Features

Bug fixes

Features

Breaking changes

Features

Features

Breaking changes

Bug fixes

Bug fixes

Bug fixes

Features

Features

Features

Bug fixes

Breaking changes

Bug fixes

Features

Notable changes

Bug fixes

Bug fixes

Bug fixes

Features

Bug fixes

Features

Bug fixes

Bug fixes

Notable changes

Bug fixes

Breaking changes

Features

Bug fixes

renovate Bot commented May 9, 2026 •

edited

Loading