Is ws 4.1 vulnerable?
npm · 1 release from 4.1.0 to 4.1.0 · latest ws is 8.22.1 · checked 2 Nov 2026
Yes: 2 known advisories
Yes. ws 4.1.0, the last 4.1 release, is affected by 2 known security advisories (2 high), including CVE-2026-48779, CVE-2024-37890. Upgrade to 5.2.5 or later to fix all of them.
Upgrade with:
npm install ws@5.2.5Advisories affecting ws 4.1.0
ws: Memory exhaustion DoS from tiny fragments and data chunks
- Affected
- >=1.1.0 <5.2.5 · >=6.0.0 <6.2.4 · >=7.0.0 <7.5.11 · >=8.0.0 <8.21.0
- Fixed in
- 5.2.5, 6.2.4, 7.5.11, 8.21.0
ws affected by a DoS when handling a request with many HTTP headers
- Affected
- >=2.1.0 <5.2.4 · >=6.0.0 <6.2.3 · >=7.0.0 <7.5.10 · >=8.0.0 <8.17.1
- Fixed in
- 5.2.4, 6.2.3, 7.5.10, 8.17.1
Which of your client projects are still on ws 4.1?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact ws version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other ws versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.