ws is a simple to use, fast, and thoroughly tested WebSocket client and server library for Node.js. It supports WebSocket features like the RFC 6455 protocol and permessage-deflate compression, and is useful for building real-time WebSocket backends.
Project status
- Actively maintained. The upstream push was on 2026-06-10, and there were multiple recent updates on 2026-05-22 across several version lines (8.x, 7.x, and 6.x).
- Ongoing/evolving with moderate cadence. In 2026, updates show up roughly on a few-month rhythm (for example, 8.19.0 in early January, 8.20.x in March, 8.21.0 in late May) with a very recent upstream activity within the last day.
AI summary generated
Recent updates
8.21.0
Release 8.21.0 introduces new flow-control options `maxBufferedChunks` and `maxFragments`, and fixes a remote memory exhaustion DoS vulnerability affecting ws servers and clients. The code diff, however, shows substantial internal refactoring and additional option surfaces that are not described in the release notes.
SecurityFeatures7.5.11
Release 7.5.11 is described only as a backport bug fix. The actual diff includes several significant WebSocket library behavior and API changes (receiver/sender/permessage-deflate internals), plus a new exported helper (createWebSocketStream) that are not called out in the release notes.
BreakingFeatures6.2.4
Release 6.2.4’s release notes only state that a single backport commit was applied to the 6.x line. However, the actual diff from 5.2.5 to 6.2.4 shows multiple substantive runtime changes in the WebSocket implementation (receiver buffering limits, permessage-deflate cleanup behavior, WebSocket server options and close lifecycle, and new buffer conversion utilities) that are not mentioned in the release notes.
Features5.2.5
Release 5.2.5 is described only as a backport of a commit onto the 5.x line. The actual code changes introduce new internal limits for buffered chunks and message fragments, and they wire those limits through WebSocketServer and WebSocket client/server setup.
Features8.20.1
Release 8.20.1 patches an issue where calling `websocket.close()` with an unsupported TypedArray as the `reason` could disclose uninitialized memory to the remote peer. The code change additionally tightens runtime validation of the `reason` argument and introduces a corresponding unit test.
8.20.0
Release 8.20.0 primarily exposes additional public entry points on the `ws` module, including `PerMessageDeflate` and helpers for `Sec-WebSocket-Extensions` and `Sec-WebSocket-Protocol` headers. The code changes also refactor how `PerMessageDeflate` is constructed internally (and tests were updated accordingly), moving server/client mode and `maxPayload` into the options object.
Features8.19.0
Release 8.19.0 adds a new `closeTimeout` option that controls how long a WebSocket will wait for the closing handshake before forcibly terminating the connection. The release notes also mention a Node.js core compatibility fix, though the specific behavioral details are not described.
Features8.18.3
Release 8.18.3 is a targeted bug fix related to WebSocket handshake handling. It ensures the HTTP response includes the Sec-WebSocket-Version header even when the client provides an invalid or unacceptable version.
8.18.2
Release 8.18.2 includes a bug fix for permessage-deflate decompression failures when the maximum payload size is exceeded, correcting the emitted error and the resulting WebSocket close code. The code changes focus on ensuring the previously stored decompression error is used consistently during error handling.
8.18.1
Release 8.18.1 is primarily a test-related fix, shortening UNIX domain socket path components so the tests work reliably in CITGM. The diff also includes small internal/doc type contract tweaks and a CI matrix update, plus an ESLint configuration dependency bump.