# ws (npm) vulnerabilities 6 known vulnerabilities (2 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 8.22.1 (Oct 31, 2026): no advisory affects it - Newest unaffected release: 8.22.1 (Oct 31, 2026), the latest release - Weekly downloads: 382.6M - Dependents: 181.5K - Releases: 190 since 0.2.6 (Dec 4, 2011) - Registry: https://www.npmjs.com/package/ws - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-48779: 1.1.0 to 5.2.4 (5.2.5 is outside it); 6.0.0 to 6.2.3 (6.2.4 is outside it); 7.0.0 to 7.5.10 (7.5.11 is outside it); 8.0.0 to 8.20.1 (8.21.0 is outside it) - CVE-2026-45736: 8.0.0 to 8.20.0 (8.20.1 is outside it) - CVE-2024-37890: 2.1.0 to 5.2.3 (5.2.4 is outside it); 6.0.0 to 6.2.2 (6.2.3 is outside it); 7.0.0 to 7.5.9 (7.5.10 is outside it); 8.0.0 to 8.17.0 (8.17.1 is outside it) - CVE-2021-32640: 5.0.0 to 5.2.2 (5.2.3 is outside it); 6.0.0 to 6.2.1 (6.2.2 is outside it); 7.0.0 to 7.4.5 (7.4.6 is outside it) - CVE-2016-10542: 0.2.6 to 1.1.0 (1.1.1 is outside it) - CVE-2016-10518: 0.2.6 to 1.0.0 (1.0.1 is outside it) ## Advisories (6) ### [CVE-2026-48779](https://cve.now/CVE-2026-48779): ws: Memory exhaustion DoS from tiny fragments and data chunks - Severity: High 7.5 - Published: Jun 16, 2026 - Affected: from 1.1.0, fixed in 5.2.5; from 6.0.0, fixed in 6.2.4; from 7.0.0, fixed in 7.5.11; from 8.0.0, fixed in 8.21.0. - Fixed in 5.2.5 (released May 22, 2026, 25 days before disclosure), 6.2.4 (released May 22, 2026, 25 days before disclosure), 7.5.11 (released May 22, 2026, 25 days before disclosure) and 1 other version. - The latest release, 8.22.1, is not affected. - 34% of ws downloads last week were affected versions (148.2M). ### [CVE-2026-45736](https://cve.now/CVE-2026-45736): ws: Uninitialized memory disclosure - Severity: Medium 4.4 - Published: May 15, 2026 - Affected: from 8.0.0, fixed in 8.20.1. - Fixed in 8.20.1 (released May 12, 2026, 3 days before disclosure). - The latest release, 8.22.1, is not affected. - 22% of ws downloads last week were affected versions (95.6M). ### [CVE-2024-37890](https://cve.now/CVE-2024-37890): Denial of service when handling a request with many HTTP headers in ws - Severity: High 7.5 - Published: Jun 17, 2024 - Affected: from 2.1.0, fixed in 5.2.4; from 6.0.0, fixed in 6.2.3; from 7.0.0, fixed in 7.5.10; from 8.0.0, fixed in 8.17.1. - Fixed in 5.2.4 (released Jun 16, 2024, 1 day before disclosure), 6.2.3 (released Jun 16, 2024, 1 day before disclosure), 7.5.10 (released Jun 16, 2024, 1 day before disclosure) and 1 other version. - The latest release, 8.22.1, is not affected. - 6.5% of ws downloads last week were affected versions (28.5M). ### [CVE-2021-32640](https://cve.now/CVE-2021-32640): ReDoS in Sec-Websocket-Protocol header - Severity: Medium 5.3 - Published: May 25, 2021 - Affected: from 7.0.0, fixed in 7.4.6; from 6.0.0, fixed in 6.2.2; from 5.0.0, fixed in 5.2.3. - Fixed in 5.2.3 (released Jun 8, 2021, 14 days after disclosure), 6.2.2 (released Jun 1, 2021, 7 days after disclosure) and 7.4.6 (released May 25, 2021, the day of disclosure). - The latest release, 8.22.1, is not affected. - 0.9% of ws downloads last week were affected versions (4.1M). ### [CVE-2016-10542](https://cve.now/CVE-2016-10542): ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". - Severity: Unrated - Published: May 31, 2018 - Affected: fixed in 1.1.1. - Fixed in 1.1.1 (released Jun 24, 2016, 706 days before disclosure). - The latest release, 8.22.1, is not affected. - <0.1% of ws downloads last week were affected versions (219.7K). ### [CVE-2016-10518](https://cve.now/CVE-2016-10518): A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a… - Severity: Unrated - Published: May 31, 2018 - Affected: fixed in 1.0.1. - Fixed in 1.0.1 (released Jan 4, 2016, 878 days before disclosure). - The latest release, 8.22.1, is not affected. - <0.1% of ws downloads last week were affected versions (172.9K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/ws Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.