Releases: websockets/ws
8.1.0
8.0.0
Breaking changes
-
The
WebSocketconstructor now throws aSyntaxErrorif any of the
subprotocol names are invalid or duplicated (0aecf0c). -
The server now aborts the opening handshake if an invalid
Sec-WebSocket-Protocolheader field value is received (1877dde). -
The
protocolsargument ofhandleProtocolshook is no longer anArraybut
aSet(1877dde). -
The opening handshake is now aborted if the
Sec-WebSocket-Extensionsheader
field value is empty or it begins or ends with a white space (e814110). -
Dropped support for Node.js < 10.0.0 (552b506).
-
The
WebSocketconstructor now throws aSyntaxErrorif the connection URL
contains a fragment identifier or if the URL's protocol is not one of'ws:',
'wss:', or'ws+unix:'(ebea038). -
Text messages and close reasons are no longer decoded to strings. They are
passed asBuffers to the listeners of their respective events. The listeners
of the'message'event now take a boolean argument specifying whether or not
the message is binary (e173423).Existing code can be migrated by decoding the buffer explicitly.
websocket.on('message', function message(data, isBinary) { const message = isBinary ? data : data.toString(); // Continue as before. }); websocket.on('close', function close(code, data) { const reason = data.toString(); // Continue as before. });
-
The package now uses an ES module wrapper (78adf5f).
-
WebSocketServer.prototype.close()no longer closes existing connections
(df7de57).Existing code can be migrated by closing the connections manually.
websocketServer.close(); for (const ws of websocketServer.clients) { ws.terminate(); }
-
The callback of
WebSocketServer.prototype.close()is now called with an
error if the server is already closed (abde9cf). -
WebSocket.prototype.addEventListener()is now a noop if thetypeargument
is not one of'close','error','message', or'open'(9558ed1). -
WebSocket.prototype.removeEventListener()now only removes listeners added
withWebSocket.prototype.addEventListener()and only one at time (ea95d9c). -
The value of the
onclose,onerror,onmessage, andonopenproperties is
nownullif the respective event handler is not set (6756cf5). -
The
OpenEventclass has been removed (21e6500).
Bug fixes
- The event listeners added via handler properties are now independent from the
event listeners added withWebSocket.prototype.addEventListener()
(0b21c03).
7.5.3
Bug fixes
- The
WebSocketServerconstructor now throws an error if more than one of the
noServer,server, andportoptions are specefied (66e58d2). - Fixed a bug where a
'close'event was emitted by aWebSocketServerbefore
the internal HTTP/S server was actually closed (5a58730). - Fixed a bug that allowed WebSocket connections to be established after
WebSocketServer.prototype.close()was called (772236a).
7.5.2
7.5.1
7.5.0
Features
- Some errors now have a
codeproperty describing the specific type of error
that has occurred (#1901).
Bug fixes
5.2.3
6.2.2
7.4.6
Bug fixes
- Fixed a ReDoS vulnerability (00c425e).
A specially crafted value of the Sec-Websocket-Protocol header could be used
to significantly slow down a ws server.
for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
const value = 'b' + ' '.repeat(length) + 'x';
const start = process.hrtime.bigint();
value.trim().split(/ *, */);
const end = process.hrtime.bigint();
console.log('length = %d, time = %f ns', length, end - start);
}The vulnerability was responsibly disclosed along with a fix in private by
Robert McLaughlin from University of California, Santa Barbara.
In vulnerable versions of ws, the issue can be mitigated by reducing the maximum
allowed length of the request headers using the --max-http-header-size=size
and/or the maxHeaderSize options.