Skip to main content
cve.nowby Sazabi
← npm
npmPackage

ws

6 known vulnerabilities (2 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
8.22.1 (Oct 31, 2026): no advisory affects it
Newest unaffected release
8.22.1 (Oct 31, 2026), the latest release
Advisories
6 · 2 high, 2 medium
Weekly downloads
382.6M
Dependents
181.5K
Releases
190 since 0.2.6 (Dec 4, 2011)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-48779
    Affects 1.1.0 to 5.2.4 (5.2.5 is outside it); 6.0.0 to 6.2.3 (6.2.4 is outside it); 7.0.0 to 7.5.10 (7.5.11 is outside it); 8.0.0 to 8.20.1 (8.21.0 is outside it)
  • CVE-2026-45736
    Affects 8.0.0 to 8.20.0 (8.20.1 is outside it)
  • CVE-2024-37890
    Affects 2.1.0 to 5.2.3 (5.2.4 is outside it); 6.0.0 to 6.2.2 (6.2.3 is outside it); 7.0.0 to 7.5.9 (7.5.10 is outside it); 8.0.0 to 8.17.0 (8.17.1 is outside it)
  • CVE-2021-32640
    Affects 5.0.0 to 5.2.2 (5.2.3 is outside it); 6.0.0 to 6.2.1 (6.2.2 is outside it); 7.0.0 to 7.4.5 (7.4.6 is outside it)
  • CVE-2016-10542
    Affects 0.2.6 to 1.1.0 (1.1.1 is outside it)
  • CVE-2016-10518
    Affects 0.2.6 to 1.0.0 (1.0.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • ws: Memory exhaustion DoS from tiny fragments and data chunks

    Affected: from 1.1.0, fixed in 5.2.5; from 6.0.0, fixed in 6.2.4; from 7.0.0, fixed in 7.5.11; from 8.0.0, fixed in 8.21.0.

    Fixed in 5.2.5 (released May 22, 2026, 25 days before disclosure), 6.2.4 (released May 22, 2026, 25 days before disclosure), 7.5.11 (released May 22, 2026, 25 days before disclosure) and 1 other version.

    The latest release, 8.22.1, is not affected.

    34% of ws downloads last week were affected versions (148.2M).

  • CVE-2026-45736Medium 4.4

    ws: Uninitialized memory disclosure

    Affected: from 8.0.0, fixed in 8.20.1.

    Fixed in 8.20.1 (released May 12, 2026, 3 days before disclosure).

    The latest release, 8.22.1, is not affected.

    22% of ws downloads last week were affected versions (95.6M).

  • Denial of service when handling a request with many HTTP headers in ws

    Affected: from 2.1.0, fixed in 5.2.4; from 6.0.0, fixed in 6.2.3; from 7.0.0, fixed in 7.5.10; from 8.0.0, fixed in 8.17.1.

    Fixed in 5.2.4 (released Jun 16, 2024, 1 day before disclosure), 6.2.3 (released Jun 16, 2024, 1 day before disclosure), 7.5.10 (released Jun 16, 2024, 1 day before disclosure) and 1 other version.

    The latest release, 8.22.1, is not affected.

    6.5% of ws downloads last week were affected versions (28.5M).

  • CVE-2021-32640Medium 5.3

    ReDoS in Sec-Websocket-Protocol header

    Affected: from 7.0.0, fixed in 7.4.6; from 6.0.0, fixed in 6.2.2; from 5.0.0, fixed in 5.2.3.

    Fixed in 5.2.3 (released Jun 8, 2021, 14 days after disclosure), 6.2.2 (released Jun 1, 2021, 7 days after disclosure) and 7.4.6 (released May 25, 2021, the day of disclosure).

    The latest release, 8.22.1, is not affected.

    0.9% of ws downloads last week were affected versions (4.1M).

  • ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455".

    Affected: fixed in 1.1.1.

    Fixed in 1.1.1 (released Jun 24, 2016, 706 days before disclosure).

    The latest release, 8.22.1, is not affected.

    <0.1% of ws downloads last week were affected versions (219.7K).

  • A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a…

    Affected: fixed in 1.0.1.

    Fixed in 1.0.1 (released Jan 4, 2016, 878 days before disclosure).

    The latest release, 8.22.1, is not affected.

    <0.1% of ws downloads last week were affected versions (172.9K).