ws is a simple to use, fast, and thoroughly tested WebSocket client and server library for Node.js. It supports WebSocket features like the RFC 6455 protocol and permessage-deflate compression, and is useful for building real-time WebSocket backends.
Project status
- Active maintenance: The repository shows a recent upstream push on 2026-05-22, with multiple version lines updated the same day, indicating ongoing development rather than maintenance-only mode.
- Apparent update cadence: At least three different update tags (8.21.0, 7.5.11, 6.2.4) appear on 2026-05-22, suggesting active work across supported major lines, though the evidence only covers this single day.
AI summary generated Today
Recent updates
8.21.0
2 weeks agoRelease 8.21.0 introduces new flow-control options `maxBufferedChunks` and `maxFragments`, and fixes a remote memory exhaustion DoS vulnerability affecting ws servers and clients. The code diff, however, shows substantial internal refactoring and additional option surfaces that are not described in the release notes.
SecurityFeatures7.5.11
2 weeks agoRelease 7.5.11 is described only as a backport bug fix. The actual diff includes several significant WebSocket library behavior and API changes (receiver/sender/permessage-deflate internals), plus a new exported helper (createWebSocketStream) that are not called out in the release notes.
BreakingFeatures6.2.4
2 weeks agoRelease 6.2.4’s release notes only state that a single backport commit was applied to the 6.x line. However, the actual diff from 5.2.5 to 6.2.4 shows multiple substantive runtime changes in the WebSocket implementation (receiver buffering limits, permessage-deflate cleanup behavior, WebSocket server options and close lifecycle, and new buffer conversion utilities) that are not mentioned in the release notes.
Features5.2.5
2 weeks agoRelease 5.2.5 is described only as a backport of a commit onto the 5.x line. The actual code changes introduce new internal limits for buffered chunks and message fragments, and they wire those limits through WebSocketServer and WebSocket client/server setup.
Features8.20.1
3 weeks agoRelease 8.20.1 patches an issue where calling `websocket.close()` with an unsupported TypedArray as the `reason` could disclose uninitialized memory to the remote peer. The code change additionally tightens runtime validation of the `reason` argument and introduces a corresponding unit test.
8.20.0
2 months agoRelease 8.20.0 primarily exposes additional public entry points on the `ws` module, including `PerMessageDeflate` and helpers for `Sec-WebSocket-Extensions` and `Sec-WebSocket-Protocol` headers. The code changes also refactor how `PerMessageDeflate` is constructed internally (and tests were updated accordingly), moving server/client mode and `maxPayload` into the options object.
Features8.19.0
5 months agoRelease 8.19.0 adds a new `closeTimeout` option that controls how long a WebSocket will wait for the closing handshake before forcibly terminating the connection. The release notes also mention a Node.js core compatibility fix, though the specific behavioral details are not described.
Features8.18.3
11 months agoRelease 8.18.3 is a targeted bug fix related to WebSocket handshake handling. It ensures the HTTP response includes the Sec-WebSocket-Version header even when the client provides an invalid or unacceptable version.
8.18.2
5/2/2025Release 8.18.2 includes a bug fix for permessage-deflate decompression failures when the maximum payload size is exceeded, correcting the emitted error and the resulting WebSocket close code. The code changes focus on ensuring the previously stored decompression error is used consistently during error handling.
8.18.1
2/21/2025Release 8.18.1 is primarily a test-related fix, shortening UNIX domain socket path components so the tests work reliably in CITGM. The diff also includes small internal/doc type contract tweaks and a CI matrix update, plus an ESLint configuration dependency bump.