chore(renovate): Security update Update dependency ws to ^8.20.1 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ws	^8.18.0 → ^8.20.1

---

ws affected by a DoS when handling a request with many HTTP headers

CVE-2024-37890 / GHSA-3h5v-q93c-6h6q

More information

Details

Impact

A request with a number of headers exceeding the server.maxHeadersCount threshold could be used to crash a ws server.

Proof of concept

const http = require('http');
const WebSocket = require('ws');

const wss = new WebSocket.Server({ port: 0 }, function () {
  const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
  const headers = {};
  let count = 0;

  for (let i = 0; i < chars.length; i++) {
    if (count === 2000) break;

    for (let j = 0; j < chars.length; j++) {
      const key = chars[i] + chars[j];
      headers[key] = 'x';

      if (++count === 2000) break;
    }
  }

  headers.Connection = 'Upgrade';
  headers.Upgrade = 'websocket';
  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
  headers['Sec-WebSocket-Version'] = '13';

  const request = http.request({
    headers: headers,
    host: '127.0.0.1',
    port: wss.address().port
  });

  request.end();
});

Patches

The vulnerability was fixed in ws@8.17.1 (websockets/ws@e55e510) and backported to ws@7.5.10 (websockets/ws@22c2876), ws@6.2.3 (websockets/ws@eeb76d3), and ws@5.2.4 (websockets/ws@4abd8f6).

Workarounds

In vulnerable versions of ws, the issue can be mitigated in the following ways:

1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent.
2. Set server.maxHeadersCount to 0 so that no limit is applied.

Credits

The vulnerability was reported by Ryan LaPointe in https://github.com/websockets/ws/issues/2230.

References

• GHSA-3h5v-q93c-6h6q
• https://www.cve.org/CVERecord?id=CVE-2024-37890
• https://github.com/websockets/ws/issues/2230
• https://github.com/websockets/ws/pull/2231

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
• https://github.com/websockets/ws/issues/2230
• https://github.com/websockets/ws/pull/2231
• https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
• https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
• https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
• https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
• https://github.com/advisories/GHSA-3h5v-q93c-6h6q

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

ReDoS in Sec-Websocket-Protocol header

CVE-2021-32640 / GHSA-6fc8-4gx4-v693

More information

Details

Impact

A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server.

Proof of concept

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}

Patches

The vulnerability was fixed in ws@7.4.6 (websockets/ws@00c425e) and backported to ws@6.2.2 (websockets/ws@78c676d) and ws@5.2.3 (websockets/ws@76d47c1).

Workarounds

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

Credits

The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693
• https://nvd.nist.gov/vuln/detail/CVE-2021-32640
• https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff
• https://github.com/websockets/ws/issues/1895
• https://lists.apache.org/thread.html/rdfa7b6253c4d6271e31566ecd5f30b7ce1b8fb2c89d52b8c4e0f4e30@%3Ccommits.tinkerpop.apache.org%3E
• https://security.netapp.com/advisory/ntap-20210706-0005/
• https://github.com/advisories/GHSA-6fc8-4gx4-v693

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

ws: Uninitialized memory disclosure

CVE-2026-45736 / GHSA-58qx-3vcg-4xpx

More information

Details

Impact

The websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.

Proof of concept

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer(
  { port: 0, skipUTF8Validation: true },
  function () {
    const { port } = wss.address();
    const ws = new WebSocket(`ws://localhost:${port}`, {
      skipUTF8Validation: true
    });

    ws.on('close', function (code, reason) {
      deepStrictEqual(reason, Buffer.alloc(80));
    });
  }
);

wss.on('connection', function (ws) {
  ws.close(1000, new Float32Array(20));
});

Patches

The vulnerability was fixed in ws@8.20.1 (websockets/ws@c0327ec).

Credits

Credit for the private and responsible disclosure of this issue goes to Nikita Skovoroda.

Remarks

Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.

Resources

• GHSA-58qx-3vcg-4xpx
• https://www.cve.org/CVERecord?id=CVE-2026-45736

Severity

• CVSS Score: 4.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx
• https://nvd.nist.gov/vuln/detail/CVE-2026-45736
• https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086
• https://github.com/advisories/GHSA-58qx-3vcg-4xpx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

websockets/ws (ws)

v8.20.1

Compare Source

Bug fixes

• Fixed an uninitialized memory disclosure issue in websocket.close()
  (c0327ec).

Providing a TypedArray (e.g. Float32Array) as the reason argument for
websocket.close(), rather than the supported string or Buffer types, caused
uninitialized memory to be disclosed to the remote peer.

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer(
  { port: 0, skipUTF8Validation: true },
  function () {
    const { port } = wss.address();
    const ws = new WebSocket(`ws://localhost:${port}`, {
      skipUTF8Validation: true
    });

    ws.on('close', function (code, reason) {
      deepStrictEqual(reason, Buffer.alloc(80));
    });
  }
);

wss.on('connection', function (ws) {
  ws.close(1000, new Float32Array(20));
});

The issue was privately reported by Nikita Skovoroda.

v8.20.0

Compare Source

Features

• Added exports for the PerMessageDeflate class and utilities for the
  Sec-WebSocket-Extensions and Sec-WebSocket-Protocol headers (d3503c1).

v8.19.0

Compare Source

Features

• Added the closeTimeout option (#​2308).

Bug fixes

• Handled a forthcoming breaking change in Node.js core (1998485).

v8.18.3

Compare Source

Bug fixes

• Fixed a spec violation where the Sec-WebSocket-Version header was not added
  to the HTTP response if the client requested version was either invalid or
  unacceptable (#​2291).

v8.18.2

Compare Source

Bug fixes

• Fixed an issue that, during message decompression when the maximum size was
  exceeded, led to the emission of an inaccurate error and closure of the
  connection with an improper close code (#​2285).

v8.18.1

Compare Source

Bug fixes

• The length of the UNIX domain socket paths in the tests has been shortened to
  make them work when run via CITGM (021f7b8).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
nexeraid-example-airdrop-v2	Ready	Preview	Sep 10, 2026 10:50pm UTC
nexeraid-examples-v2	Ready	Preview	Sep 10, 2026 10:50pm UTC
thea-examples	Error		Sep 10, 2026 10:50pm UTC