Is ws 1.1 vulnerable?
npm · 6 releases from 1.1.0 to 1.1.5 · latest ws is 8.22.1 · checked 2 Nov 2026
Yes: 1 known advisory
Yes. ws 1.1.5, the last 1.1 release, is affected by 1 known security advisory (1 high), including CVE-2026-48779. 2 more affect earlier 1.1.x releases. Upgrade to 5.2.5 or later to fix all of them.
npm install ws@5.2.5Advisories affecting ws 1.1.5
ws: Memory exhaustion DoS from tiny fragments and data chunks
- Affected
- >=1.1.0 <5.2.5 · >=6.0.0 <6.2.4 · >=7.0.0 <7.5.11 · >=8.0.0 <8.21.0
- Fixed in
- 5.2.5, 6.2.4, 7.5.11, 8.21.0
Fixed within 1.1.x, affecting earlier releases
Denial of Service in ws
- Affected
- >=0.6.0 <1.1.5 · >=2.0.0 <3.3.1
- Fixed in
- 1.1.5, 3.3.1
DoS due to excessively large websocket message in ws
- Affected
- <1.1.1
- Fixed in
- 1.1.1
Which of your client projects are still on ws 1.1?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact ws version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other ws versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.