ws 8.2.2 | Snyk

Direct Vulnerabilities

Known vulnerabilities in the ws package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Asymmetric Resource Consumption (Amplification) ws is a simple to use websocket client, server and console for node.js. Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) when handling a large number of very small fragments and data chunks. An attacker can cause excessive memory allocation and OOM by sending a high volume of tiny WebSocket frames How to fix Asymmetric Resource Consumption (Amplification)? Upgrade `ws` to version 5.2.5, 6.2.4, 7.5.11, 8.21.0 or higher.	>=1.1.0 <5.2.5>=6.0.0 <6.2.4>=7.0.0 <7.5.11>=8.0.0 <8.21.0
M Use of Uninitialized Resource ws is a simple to use websocket client, server and console for node.js. Affected versions of this package are vulnerable to Use of Uninitialized Resource in the `websocket.close()` implementation in the `Sender` class, which exposes uninitialized memory when a `TypedArray` is provided as the `reason` argument. Note: The project maintainers note that this "flaw is only exploitable through misuse that is unlikely in practice". How to fix Use of Uninitialized Resource? Upgrade `ws` to version 8.20.1 or higher.	>=8.0.0 <8.20.1
H Denial of Service (DoS) ws is a simple to use websocket client, server and console for node.js. Affected versions of this package are vulnerable to Denial of Service (DoS) when the number of received headers exceed the `server.maxHeadersCount` or `request.maxHeadersCount` threshold. How to fix Denial of Service (DoS)? Upgrade `ws` to version 5.2.4, 6.2.3, 7.5.10, 8.17.1 or higher.	>=2.1.0 <5.2.4>=6.0.0 <6.2.3>=7.0.0 <7.5.10>=8.0.0 <8.17.1

Vulnerability

Vulnerable Version

Asymmetric Resource Consumption (Amplification)

ws is a simple to use websocket client, server and console for node.js.

Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) when handling a large number of very small fragments and data chunks. An attacker can cause excessive memory allocation and OOM by sending a high volume of tiny WebSocket frames

How to fix Asymmetric Resource Consumption (Amplification)?

Upgrade ws to version 5.2.5, 6.2.4, 7.5.11, 8.21.0 or higher.

>=1.1.0 <5.2.5>=6.0.0 <6.2.4>=7.0.0 <7.5.11>=8.0.0 <8.21.0

Use of Uninitialized Resource

ws is a simple to use websocket client, server and console for node.js.

Affected versions of this package are vulnerable to Use of Uninitialized Resource in the websocket.close() implementation in the Sender class, which exposes uninitialized memory when a TypedArray is provided as the reason argument.

Note: The project maintainers note that this "flaw is only exploitable through misuse that is unlikely in practice".

How to fix Use of Uninitialized Resource?

Upgrade ws to version 8.20.1 or higher.

>=8.0.0 <8.20.1

Denial of Service (DoS)

ws is a simple to use websocket client, server and console for node.js.

Affected versions of this package are vulnerable to Denial of Service (DoS) when the number of received headers exceed the server.maxHeadersCount or request.maxHeadersCount threshold.

How to fix Denial of Service (DoS)?

Upgrade ws to version 5.2.4, 6.2.3, 7.5.10, 8.17.1 or higher.

>=2.1.0 <5.2.4>=6.0.0 <6.2.3>=7.0.0 <7.5.10>=8.0.0 <8.17.1

ws@8.2.2

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically