Is ws 5.2 vulnerable?
npm · 8 releases from 5.2.0 to 5.2.7 · latest ws is 8.22.1 · checked 1 Nov 2026
No known advisories in the last release
ws 5.2.7, the last 5.2 release, has no known advisories. 3 advisories affect earlier 5.2.x releases, so update to 5.2.7.
Update within 5.2:
npm install ws@5.2.7Fixed within 5.2.x, affecting earlier releases
ws: Memory exhaustion DoS from tiny fragments and data chunks
- Affected
- >=1.1.0 <5.2.5 · >=6.0.0 <6.2.4 · >=7.0.0 <7.5.11 · >=8.0.0 <8.21.0
- Fixed in
- 5.2.5, 6.2.4, 7.5.11, 8.21.0
ws affected by a DoS when handling a request with many HTTP headers
- Affected
- >=2.1.0 <5.2.4 · >=6.0.0 <6.2.3 · >=7.0.0 <7.5.10 · >=8.0.0 <8.17.1
- Fixed in
- 5.2.4, 6.2.3, 7.5.10, 8.17.1
ReDoS in Sec-Websocket-Protocol header
- Affected
- >=7.0.0 <7.4.6 · >=6.0.0 <6.2.2 · >=5.0.0 <5.2.3
- Fixed in
- 5.2.3, 6.2.2, 7.4.6
Which of your client projects are still on ws 5.2?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact ws version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other ws versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.