npm / ws
ws
What changed in ws 7 to 8, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
2 breaking2 security6 new APIs and options1 behavior and defaults3 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initws 813 changes
Breaking changes 2
The server now rejects offers whose client_max_window_bits is smaller than configured clientMaxWindowBits.
The default value of maxFragments has been reduced.
Security 2
Fixed a vulnerability where tiny fragments and data chunks could crash a ws server or client due to OOM.
Prevents uninitialized memory disclosure when an unsupported TypedArray is passed as the reason argument.
New APIs and options 6
Introduced the protocols option.
Introduced maxBufferedChunks to configure buffering limits.
Introduced maxFragments to configure fragment limits.
The PerMessageDeflate class is now exported for developer use.
Utilities for the Sec-WebSocket-Extensions header are now exported.
Added the closeTimeout option.
Behavior and default changes 1
The default value of maxBufferedChunks has been reduced.
Fixes and other changes 2
Invalid arguments no longer transition the state to WebSocket.CLOSING.
Handled a forthcoming breaking change in Node.js core.
ws 71 changes
Fixes and other changes 1
Fixed the fragment counter failing to reset, restoring the expected reset behavior.