ws vulnerabilities
Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js
- Registry
- npm
- Latest
- 8.22.0
- License
- MIT
7 known advisories
The latest version, 8.22.0, is not affected by any of them. Projects on older versions may be.
npm install ws@8.22.0Security advisories for ws
ws: Memory exhaustion DoS from tiny fragments and data chunks
- Affected
- >=1.1.0 <5.2.5 · >=6.0.0 <6.2.4 · >=7.0.0 <7.5.11 · >=8.0.0 <8.21.0
- Fixed in
- 5.2.5, 6.2.4, 7.5.11, 8.21.0
ws: Uninitialized memory disclosure
- Affected
- >=8.0.0 <8.20.1
- Fixed in
- 8.20.1
ws affected by a DoS when handling a request with many HTTP headers
- Affected
- >=2.1.0 <5.2.4 · >=6.0.0 <6.2.3 · >=7.0.0 <7.5.10 · >=8.0.0 <8.17.1
- Fixed in
- 5.2.4, 6.2.3, 7.5.10, 8.17.1
ReDoS in Sec-Websocket-Protocol header
- Affected
- >=7.0.0 <7.4.6 · >=6.0.0 <6.2.2 · >=5.0.0 <5.2.3
- Fixed in
- 5.2.3, 6.2.2, 7.4.6
Denial of Service in ws
- Affected
- >=0.6.0 <1.1.5 · >=2.0.0 <3.3.1
- Fixed in
- 1.1.5, 3.3.1
DoS due to excessively large websocket message in ws
- Affected
- <1.1.1
- Fixed in
- 1.1.1
Remote Memory Disclosure in ws
- Affected
- <1.0.1
- Fixed in
- 1.0.1
Which of your client projects still run an old ws?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.