MrUnknownDE opened issue MrUnknownDE/UnknownBot#4

MrUnknownDE
Sun, 05 Apr 2026 16:15:22 +0200

4#Bump ws from 7.4.3 to 7.4.6#

Originally created by @dependabot[bot] on 5/31/2021

Bumps ws from 7.4.3 to 7.4.6.

Release notes

Sourced from ws's releases.

7.4.6

Bug fixes

Fixed a ReDoS vulnerability (00c425ec).

A specially crafted value of the Sec-Websocket-Protocol header could be used to significantly slow down a ws server.

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

value.trim().split(/ *, */);


const end = process.hrtime.bigint();


console.log('length = %d, time = %f ns', length, end - start);
}

The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

7.4.5

Bug fixes

UTF-8 validation is now done even if utf-8-validate is not installed (23ba6b29).

Fixed an edge case where websocket.close() and websocket.terminate() did not close the connection (67e25ff5).

7.4.4

Bug fixes

Fixed a bug that could cause the process to crash when using the permessage-deflate extension (92774377).

Commits

f5297f7 [dist] 7.4.6

00c425e [security] Fix ReDoS vulnerability

990306d [lint] Fix prettier error

32e3a84 [security] Remove reference to Node Security Project

8c914d1 [minor] Fix nits

fc7e27d [ci] Test on node 16

587c201 [ci] Do not test on node 15

f672710 [dist] 7.4.5

67e25ff [fix] Fix case where abortHandshake() does not close the connection

23ba6b2 [fix] Make UTF-8 validation work even if utf-8-validate is not installed

Additional commits viewable in compare view