7.4.6

Bug fixes

• Fixed a ReDoS vulnerability (00c425e).

A specially crafted value of the Sec-Websocket-Protocol header could be used
to significantly slow down a ws server.

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}

The vulnerability was responsibly disclosed along with a fix in private by
Robert McLaughlin from University of California, Santa Barbara.

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum
allowed length of the request headers using the --max-http-header-size=size
and/or the maxHeaderSize options.

7.4.5

Bug fixes

• UTF-8 validation is now done even if utf-8-validate is not installed
  (23ba6b2).
• Fixed an edge case where websocket.close() and websocket.terminate() did
  not close the connection (67e25ff).

7.4.4

Bug fixes

• Fixed a bug that could cause the process to crash when using the
  permessage-deflate extension (9277437).

7.4.3

Bug fixes

• The deflate/inflate stream is now reset instead of reinitialized when context
  takeover is disabled (#1840).

7.4.2

Bug fixes

• Silenced a deprecation warning (a2c0d44).

7.4.1

Bug fixes

• Added a workaround for a double 'error' event bug in Node.js < 13 which
  caused an uncaught error during the WebSocket handshake (38d6ab3).

7.4.0

Features

• The callback of WebSocketServer.prototype.handleUpgrade() now takes the
  client HTTP GET request as second argument (7d39f19).

Bug fixes

• Read-only properties are now read-only (eabed8f).
• The CONNECTING, OPEN, CLOSING, CLOSED, binaryType, bufferedAmount,
  extensions, onclose, onerror, onmessage, onopen, protocol,
  readyState, and url properties are now enumerable (2069e68).

7.3.1

Bug fixes

• Improved websocket.bufferedAmount accuracy (e1349c0, a162942).

7.3.0

Features

• WebSocket.prototype.addEventListener() now supports the once option (#1754).

7.2.5

Bug fixes

• Fixed compatibility with Node.js master (651d662).