ws

8.22.0 · 26 Sep 2026MIT173.4M / weekRepository npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for ws. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	8.22.0	Safe from 8.21.0
	7.5.13	Safe from 7.5.11
	6.2.6	Safe from 6.2.4
	5.2.7	Safe from 5.2.5
	4.1.0	25 open advisories, worst high · last release Feb 2018, no longer updated

Your version

High
ws: Memory exhaustion DoS from tiny fragments and data chunksGHSA-96hv-2xvq-fx4p · 15 Jun 2026
- 8.x8.0.0 – 8.20.1Fixed in 8.21.0
- 7.x7.0.0 – 7.5.10Fixed in 7.5.11
- 6.x6.0.0 – 6.2.3Fixed in 6.2.4
- 5.x5.0.0 – 5.2.4Fixed in 5.2.5
- 4.x and older1.1.0 – 4.1.0No fix, no longer updated · move to 5.2.5
High
ws affected by a DoS when handling a request with many HTTP headersGHSA-3h5v-q93c-6h6q · 17 Jun 2024
- 8.x8.0.0 – 8.17.0Fixed in 8.17.1
- 7.x7.0.0 – 7.5.9Fixed in 7.5.10
- 6.x6.0.0 – 6.2.2Fixed in 6.2.3
- 5.x5.0.0 – 5.2.3Fixed in 5.2.4
- 4.x and older2.1.0 – 4.1.0No fix, no longer updated · move to 5.2.4
High
Denial of Service in wsGHSA-5v72-xg48-5rpm · 4 Jun 2019
- 3.x3.0.0 – 3.3.0Fixed in 3.3.1
- 2.x2.0.0 – 2.3.1No fix on 2.x · move to 3.3.1
- 1.x1.0.0 – 1.1.4Fixed in 1.1.5
- 0.8.x and older0.6.0 – 0.8.1No fix, no longer updated · move to 1.1.5
High
DoS due to excessively large websocket message in wsGHSA-6663-c963-2gqg · 18 Feb 2019
- 1.x1.0.0 – 1.1.0Fixed in 1.1.1
- 0.8.x and older0.2.6 – 0.8.1No fix, no longer updated · move to 1.1.1
Moderate
ws: Uninitialized memory disclosureGHSA-58qx-3vcg-4xpx · 18 May 2026
- 8.x8.0.0 – 8.20.0Fixed in 8.20.1
Moderate
ReDoS in Sec-Websocket-Protocol headerGHSA-6fc8-4gx4-v693 · 28 May 2021
- 7.x7.0.0 – 7.4.5Fixed in 7.4.6
- 6.x6.0.0 – 6.2.1Fixed in 6.2.2
- 5.x5.0.0 – 5.2.2Fixed in 5.2.3
Low
Remote Memory Disclosure in wsGHSA-2mhh-w6q8-5hxw · 18 Feb 2019
- 1.x1.0.0Fixed in 1.0.1
- 0.8.x and older0.2.6 – 0.8.1No fix, no longer updated · move to 1.0.1

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.