ws (npm)
Simple to use, blazing fast and thoroughly tested WebSocket client and server for Node.js
Advisories
27
Latest version
8.22.0
Released Sep 26, 2026
License
MIT
OpenSSF Scorecard
5.5 / 10
How to fix
Upgrading to 8.21.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install ws@8.22.0yarn
yarn add ws@8.22.0pnpm
pnpm add ws@8.22.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-96hv-2xvq-fx4p ws: Memory exhaustion DoS from tiny fragments and data chunks |
High EPSS 1.43% |
>= 1.1.0, < 5.2.5 | 5.2.5 |
| GHSA-96hv-2xvq-fx4p ws: Memory exhaustion DoS from tiny fragments and data chunks |
High EPSS 1.43% |
>= 7.0.0, < 7.5.11 | 7.5.11 |
| GHSA-96hv-2xvq-fx4p ws: Memory exhaustion DoS from tiny fragments and data chunks |
High EPSS 1.43% |
>= 8.0.0, < 8.21.0 | 8.21.0 |
| GHSA-96hv-2xvq-fx4p ws: Memory exhaustion DoS from tiny fragments and data chunks |
High EPSS 1.43% |
>= 7.0.0, < 7.5.11 | 7.5.11 |
| GHSA-96hv-2xvq-fx4p ws: Memory exhaustion DoS from tiny fragments and data chunks |
High EPSS 1.43% |
>= 8.0.0, < 8.21.0 | 8.21.0 |
| GHSA-96hv-2xvq-fx4p ws: Memory exhaustion DoS from tiny fragments and data chunks |
High EPSS 1.43% |
>= 6.0.0, < 6.2.4 | 6.2.4 |
| GHSA-96hv-2xvq-fx4p ws: Memory exhaustion DoS from tiny fragments and data chunks |
High EPSS 1.43% |
>= 1.1.0, < 5.2.5 | 5.2.5 |
| GHSA-96hv-2xvq-fx4p ws: Memory exhaustion DoS from tiny fragments and data chunks |
High EPSS 1.43% |
>= 6.0.0, < 6.2.4 | 6.2.4 |
| GHSA-58qx-3vcg-4xpx ws: Uninitialized memory disclosure |
High EPSS 0.74% |
>= 8.0.0, < 8.20.1 | 8.20.1 |
| GHSA-58qx-3vcg-4xpx ws: Uninitialized memory disclosure |
High EPSS 0.74% |
>= 8.0.0, < 8.20.1 | 8.20.1 |
| GHSA-3h5v-q93c-6h6q ws affected by a DoS when handling a request with many HTTP headers |
High EPSS 1.36% |
>= 6.0.0, < 6.2.3 | 6.2.3 |
| GHSA-3h5v-q93c-6h6q ws affected by a DoS when handling a request with many HTTP headers |
High EPSS 1.36% |
>= 8.0.0, < 8.17.1 | 8.17.1 |
| GHSA-3h5v-q93c-6h6q ws affected by a DoS when handling a request with many HTTP headers |
High EPSS 1.36% |
>= 2.1.0, < 5.2.4 | 5.2.4 |
| GHSA-3h5v-q93c-6h6q ws affected by a DoS when handling a request with many HTTP headers |
High EPSS 1.36% |
>= 6.0.0, < 6.2.3 | 6.2.3 |
| GHSA-3h5v-q93c-6h6q ws affected by a DoS when handling a request with many HTTP headers |
High EPSS 1.36% |
>= 7.0.0, < 7.5.10 | 7.5.10 |
| GHSA-3h5v-q93c-6h6q ws affected by a DoS when handling a request with many HTTP headers |
High EPSS 1.36% |
>= 8.0.0, < 8.17.1 | 8.17.1 |
| GHSA-3h5v-q93c-6h6q ws affected by a DoS when handling a request with many HTTP headers |
High EPSS 1.36% |
>= 2.1.0, < 5.2.4 | 5.2.4 |
| GHSA-3h5v-q93c-6h6q ws affected by a DoS when handling a request with many HTTP headers |
High EPSS 1.36% |
>= 7.0.0, < 7.5.10 | 7.5.10 |
| GHSA-6fc8-4gx4-v693 ReDoS in Sec-Websocket-Protocol header |
Medium EPSS 2.82% |
>= 7.0.0, < 7.4.6 | 7.4.6 |
| GHSA-6fc8-4gx4-v693 ReDoS in Sec-Websocket-Protocol header |
Medium EPSS 2.82% |
>= 5.0.0, < 5.2.3 | 5.2.3 |
| GHSA-6fc8-4gx4-v693 ReDoS in Sec-Websocket-Protocol header |
Medium EPSS 2.82% |
>= 6.0.0, < 6.2.2 | 6.2.2 |
| GHSA-5v72-xg48-5rpm Denial of Service in ws |
High | >= 0.6.0, < 1.1.5 | 1.1.5 |
| GHSA-5v72-xg48-5rpm Denial of Service in ws |
High | >= 2.0.0, < 3.3.1 | 3.3.1 |
| GHSA-5v72-xg48-5rpm Denial of Service in ws |
High | >= 2.0.0, < 3.3.1 | 3.3.1 |
| GHSA-5v72-xg48-5rpm Denial of Service in ws |
High | >= 0.6.0, < 1.1.5 | 1.1.5 |
| GHSA-6663-c963-2gqg DoS due to excessively large websocket message in ws |
High EPSS 7.42% |
< 1.1.1 | 1.1.1 |
| GHSA-2mhh-w6q8-5hxw Remote Memory Disclosure in ws |
Low EPSS 1.98% |
< 1.0.1 | 1.0.1 |
Source: git+https://github.com/websockets/ws.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor