ws is a simple to use, fast, and thoroughly tested WebSocket client and server library for Node.js. It supports WebSocket features like the RFC 6455 protocol and permessage-deflate compression, and is useful for building real-time WebSocket backends.
Project status
- websockets/ws appears actively maintained, with upstream activity on 2026-07-17 and multiple same-day updates across several version lines (5.x, 6.x, 7.x), plus additional updates on 2026-07-14.
- The apparent update cadence is frequent in July 2026 (at least two update waves within about 3-4 weeks of the latest activity), suggesting an ongoing engineering effort rather than a quiet period.
AI summary generated
Recent updates
7.5.13
Release 7.5.13 release notes only mention a bug fix where a fragment counter stopped resetting due to a regression in 7.5.12. The included code diff (6.2.6 to 7.5.13) shows substantially broader internal refactors and API surface changes that are not described in the release notes.
Features6.2.6
Release 6.2.6 is documented as a small patch that fixes a regression from 6.2.5 where the fragment counter failed to reset. However, the code diff shows broader internal changes around buffering and fragmentation limits, buffer conversion/utilities, sender framing behavior, and permessage-deflate cleanup that are not covered by the release notes.
BreakingFeatures5.2.7
Release 5.2.7 is described as a bug fix where the fragment counter was not resetting properly after earlier messages. The code diff confirms that fragment counting state is reset, but it also introduces additional receiver limits (buffered chunks and message fragments) and new failure behavior on overflow that are not mentioned in the release notes.
Features8.21.1
Release 8.21.1 is described as a small set of bug fixes related to fragment counting and the default buffering limits. The notes specifically say empty fragments now count toward the limits, and the default values for maxBufferedChunks and maxFragments were reduced.
7.5.12
Release 7.5.12 is described as a small bug fix release, specifically backporting two commits (a2f4e7c0 and f197ac65) onto the v7.x line. The release notes do not describe the underlying behavioral or API-level changes introduced by those backports.
6.2.5
Release 6.2.5 contains a small bug-fix backport, but the included diff shows several substantive internal behavioral changes. While the release notes only mention backported commits, the code introduces new buffering and fragment limits that can cause connections to close under conditions that may previously have been tolerated.
Breaking5.2.6
Release 5.2.6 is described in the notes only as a backport of two commits. The code changes in this release add new receiver limits for buffered chunks and message fragments, adjust handshake/protocol parsing behavior, and expand the internal receiver setup API to accept the new limits.
BreakingFeatures8.21.0
Release 8.21.0 introduces new flow-control options `maxBufferedChunks` and `maxFragments`, and fixes a remote memory exhaustion DoS vulnerability affecting ws servers and clients. The code diff, however, shows substantial internal refactoring and additional option surfaces that are not described in the release notes.
SecurityFeatures7.5.11
Release 7.5.11 is described only as a backport bug fix. The actual diff includes several significant WebSocket library behavior and API changes (receiver/sender/permessage-deflate internals), plus a new exported helper (createWebSocketStream) that are not called out in the release notes.
BreakingFeatures6.2.4
Release 6.2.4’s release notes only state that a single backport commit was applied to the 6.x line. However, the actual diff from 5.2.5 to 6.2.4 shows multiple substantive runtime changes in the WebSocket implementation (receiver buffering limits, permessage-deflate cleanup behavior, WebSocket server options and close lifecycle, and new buffer conversion utilities) that are not mentioned in the release notes.
Features5.2.5
Release 5.2.5 is described only as a backport of a commit onto the 5.x line. The actual code changes introduce new internal limits for buffered chunks and message fragments, and they wire those limits through WebSocketServer and WebSocket client/server setup.
Features8.20.1
Release 8.20.1 patches an issue where calling `websocket.close()` with an unsupported TypedArray as the `reason` could disclose uninitialized memory to the remote peer. The code change additionally tightens runtime validation of the `reason` argument and introduces a corresponding unit test.
8.20.0
Release 8.20.0 primarily exposes additional public entry points on the `ws` module, including `PerMessageDeflate` and helpers for `Sec-WebSocket-Extensions` and `Sec-WebSocket-Protocol` headers. The code changes also refactor how `PerMessageDeflate` is constructed internally (and tests were updated accordingly), moving server/client mode and `maxPayload` into the options object.
Features8.19.0
Release 8.19.0 adds a new `closeTimeout` option that controls how long a WebSocket will wait for the closing handshake before forcibly terminating the connection. The release notes also mention a Node.js core compatibility fix, though the specific behavioral details are not described.
Features8.18.3
Release 8.18.3 is a targeted bug fix related to WebSocket handshake handling. It ensures the HTTP response includes the Sec-WebSocket-Version header even when the client provides an invalid or unacceptable version.
8.18.2
Release 8.18.2 includes a bug fix for permessage-deflate decompression failures when the maximum payload size is exceeded, correcting the emitted error and the resulting WebSocket close code. The code changes focus on ensuring the previously stored decompression error is used consistently during error handling.
8.18.1
Release 8.18.1 is primarily a test-related fix, shortening UNIX domain socket path components so the tests work reliably in CITGM. The diff also includes small internal/doc type contract tweaks and a CI matrix update, plus an ESLint configuration dependency bump.