npm package
ws vulnerabilities by version
The latest release, 8.22.0 (Sep 26, 2026), has no known vulnerabilities. 33% of last week’s 287.7M downloads went to versions with known vulnerabilities. OSV.dev lists 7 advisories for ws; the newest was published on Jun 15, 2026.
npm (opens in a new tab) describes it as “Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js”
- Latest release
- 8.22.0
- Sep 26, 2026, no known vulnerabilities
- Downloads last week
- 287.7M
- All versions, from npm
- Advisories on OSV.dev
- 7
- Newest Jun 15, 2026
- Licence
- MIT
Most-downloaded versions last week
From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.
Who is still on a vulnerable ws
33% of last week’s 287.7M ws downloads went to versions with known vulnerabilities.
From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.
Release lines
The newest release of each major line, from the registry. ws doesn’t publish support dates we can check.
Newest advisories
The 5 most recently published, with the versions each one affects.
CriticalCVE-2026-48779 on OSV.dev (opens in a new tab)GHSA-96hv-2xvq-fx4p
ws: Memory exhaustion DoS from tiny fragments and data chunks
Affects >= 1.1.0, < 5.2.5; >= 6.0.0, < 6.2.4; >= 7.0.0, < 7.5.11; >= 8.0.0, < 8.21.0. Published Jun 15, 2026.
WarningCVE-2026-45736 on OSV.dev (opens in a new tab)GHSA-58qx-3vcg-4xpx
ws: Uninitialized memory disclosure
Affects >= 8.0.0, < 8.20.1. Published May 18, 2026.
CriticalCVE-2024-37890 on OSV.dev (opens in a new tab)GHSA-3h5v-q93c-6h6q
ws affected by a DoS when handling a request with many HTTP headers
Affects >= 2.1.0, < 5.2.4; >= 6.0.0, < 6.2.3; >= 7.0.0, < 7.5.10; >= 8.0.0, < 8.17.1. Published Jun 17, 2024.
WarningCVE-2021-32640 on OSV.dev (opens in a new tab)GHSA-6fc8-4gx4-v693
ReDoS in Sec-Websocket-Protocol header
Affects >= 7.0.0, < 7.4.6; >= 6.0.0, < 6.2.2; >= 5.0.0, < 5.2.3. Published May 28, 2021.
CriticalGHSA-5v72-xg48-5rpm on OSV.dev (opens in a new tab)
Denial of Service in ws
Affects >= 0.6.0, < 1.1.5; >= 2.0.0, < 3.3.1. Published Jun 4, 2019.
All 7 advisories are on OSV.dev (opens in a new tab).
Which ws do you have?
Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.
How this page is checked
StackPrism reads every OSV.dev advisory for ws, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.