Skip to content

Upgrading ws 4 to 5

Breaking4.1.0 → 5.2.7Breaking2Security3Platform1New3Fixed9

Full comparisonBack to ws
BreakingUpgrade verdict

2 breaking changes and a platform requirement change and 3 security fixes.

In plain terms
  • If the server picks none of the subprotocols the client asked for, the connection now stays open instead of being closed.
  • Errors from the underlying network socket are no longer passed on as re-emitted errors.
  • The package no longer works on very old versions of Node.js; you need Node.js 4.5.0 or newer.
  • ws: Memory exhaustion DoS from tiny fragments and data chunks
Must act Top 5 of 6 that need code or config changes

Drops safe-buffer.

Installs 1 package in all (was 2).

What you must change

Breaking2
The connection is no longer closed when the server does not agree to any of the client's requested subprotocols.
5.0.0GitHub ReleaseSummarizedView source
net.Socket errors are no longer re-emitted.
net.Socket
5.0.0GitHub ReleaseSummarizedView source
Security3
ws: Memory exhaustion DoS from tiny fragments and data chunks
High · CVSS 7.5
5.2.5GitHub AdvisoryOriginalView source
ws affected by a DoS when handling a request with many HTTP headers
High · CVSS 7.5
5.2.4GitHub AdvisoryOriginalView source
ReDoS in Sec-Websocket-Protocol header
Moderate · CVSS 5.3
5.2.3GitHub AdvisoryOriginalView source
Platform1
Drops support for Node.js versions below 4.5.0.
5.0.0GitHub ReleaseSummarizedView source