v8.5.0

Compare Source

Features

• Added the ability to use a custom WebSocket class on the server (#​2007).

Bug fixes

• When following redirects, the Authorization and Cookie headers are no
  longer sent if the redirect host is different from the original host (#​2013).

v8.4.2

Compare Source

Bug fixes

• Fixed a data framing issue introduced in version 8.4.1 (#​2004).

v8.4.1

Compare Source

Notable changes

• To improve performance, strings sent via websocket.ping(),
  websocket.pong(), and websocket.send() are no longer converted to
  Buffers if the data does not need to be masked (#​2000).

v8.4.0

Compare Source

Features

• Added ability to generate custom masking keys (#​1990).

v8.3.0

Compare Source

Features

• Added ability to pause and resume a WebSocket (0a8c7a9).

Bug fixes

• Fixed a bug that could prevent the connection from being closed cleanly when
  using the stream API (ed2b803).
• When following redirects, an error is now emitted and not thrown if the
  redirect URL is invalid (#​1980).

v8.2.3

Compare Source

Bug fixes

• When context takeover is enabled, messages are now compressed even if their size
  is below the value of the perMessageDeflate.threshold option (41ae563).

v8.2.2

Compare Source

Bug fixes

• Some closing operations are now run only if needed (ec9377c).

v8.2.1

Compare Source

Bug fixes

• Fixed an issue where the socket was not resumed, preventing the connection
  from being closed cleanly (869c989).

v8.2.0

Compare Source

Features

• Added WebSocket.WebSocket as an alias for WebSocket and
  WebSocket.WebSocketServer as an alias for WebSocket.Server to fix name
  consistency and improve interoperability with the ES module wrapper (#​1935).

v8.1.0

Compare Source

Features

• Added ability to skip UTF-8 validation (#​1928).

Bug fixes

• Fixed an issue with a breaking change in Node.js master (6a72da3).
• Fixed a misleading error message (c95e695).

v8.0.0

Compare Source

Breaking changes

• The WebSocket constructor now throws a SyntaxError if any of the
  subprotocol names are invalid or duplicated (0aecf0c).

• The server now aborts the opening handshake if an invalid
  Sec-WebSocket-Protocol header field value is received (1877dde).

• The protocols argument of handleProtocols hook is no longer an Array but
  a Set (1877dde).

• The opening handshake is now aborted if the Sec-WebSocket-Extensions header
  field value is empty or it begins or ends with a white space (e814110).

• Dropped support for Node.js < 10.0.0 (552b506).

• The WebSocket constructor now throws a SyntaxError if the connection URL
  contains a fragment identifier or if the URL's protocol is not one of 'ws:',
  'wss:', or 'ws+unix:' (ebea038).

• Text messages and close reasons are no longer decoded to strings. They are
  passed as Buffers to the listeners of their respective events. The listeners
  of the 'message' event now take a boolean argument specifying whether or not
  the message is binary (e173423).

  Existing code can be migrated by decoding the buffer explicitly.

  websocket.on('message', function message(data, isBinary) {
    const message = isBinary ? data : data.toString();
    // Continue as before.
  });
  
  websocket.on('close', function close(code, data) {
    const reason = data.toString();
    // Continue as before.
  });

• The package now uses an ES module wrapper (78adf5f).

• WebSocketServer.prototype.close() no longer closes existing connections
  (df7de57).

  Existing code can be migrated by closing the connections manually.

  websocketServer.close();
  for (const ws of websocketServer.clients) {
    ws.terminate();
  }

• The callback of WebSocketServer.prototype.close() is now called with an
  error if the server is already closed (abde9cf).

• WebSocket.prototype.addEventListener() is now a noop if the type argument
  is not one of 'close', 'error', 'message', or 'open' (9558ed1).

• WebSocket.prototype.removeEventListener() now only removes listeners added
  with WebSocket.prototype.addEventListener() and only one at time (ea95d9c).

• The value of the onclose, onerror, onmessage, and onopen properties is
  now null if the respective event handler is not set (6756cf5).

• The OpenEvent class has been removed (21e6500).

Bug fixes

• The event listeners added via handler properties are now independent from the
  event listeners added with WebSocket.prototype.addEventListener()
  (0b21c03).

v7.5.7

Compare Source

Bug fixes

• Backported 6946f5f to the 7.x release line (1f72e2e).

v7.5.6

Compare Source

Bug fixes

• Backported b8186dd to the 7.x release line (73dec34).
• Backported ed2b803 to the 7.x release line (22a26af).

v7.5.5

Compare Source

Bug fixes

• Backported ec9377c to the 7.x release line (0e274ac).

v7.5.4

Compare Source

Bug fixes

• Backported 6a72da3 to the 7.x release line (76087fb).
• Backported 869c989 to the 7.x release line (2799793).

v7.5.3

Compare Source

Bug fixes

• The WebSocketServer constructor now throws an error if more than one of the
  noServer, server, and port options are specefied (66e58d2).
• Fixed a bug where a 'close' event was emitted by a WebSocketServer before
  the internal HTTP/S server was actually closed (5a58730).
• Fixed a bug that allowed WebSocket connections to be established after
  WebSocketServer.prototype.close() was called (772236a).

v7.5.2

Compare Source

Bug fixes

• The opening handshake is now aborted if the client receives a
  Sec-WebSocket-Extensions header but no extension was requested or if the
  server indicates an extension not requested by the client (aca94c8).

v7.5.1

Compare Source

Bug fixes

• Fixed an issue that prevented the connection from being closed properly if an
  error occurred simultaneously on both peers (b434b9f).

v7.5.0

Compare Source

Features

• Some errors now have a code property describing the specific type of error
  that has occurred (#​1901).

Bug fixes

• A close frame is now sent to the remote peer if an error (such as a data
  framing error) occurs (8806aa9).
• The close code is now always 1006 if no close frame is received, even if the
  connection is closed due to an error (8806aa9).

v7.4.6

Compare Source

Bug fixes

• Fixed a ReDoS vulnerability (00c425e).

A specially crafted value of the Sec-Websocket-Protocol header could be used
to significantly slow down a ws server.

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}

The vulnerability was responsibly disclosed along with a fix in private by
Robert McLaughlin from University of California, Santa Barbara.

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum
allowed length of the request headers using the --max-http-header-size=size
and/or the maxHeaderSize options.

v7.4.5

Compare Source

Bug fixes

• UTF-8 validation is now done even if utf-8-validate is not installed
  (23ba6b2).
• Fixed an edge case where websocket.close() and websocket.terminate() did
  not close the connection (67e25ff).

v7.4.4

Compare Source

Bug fixes

• Fixed a bug that could cause the process to crash when using the
  permessage-deflate extension (9277437).

v7.4.3

Compare Source

Bug fixes

• The deflate/inflate stream is now reset instead of reinitialized when context
  takeover is disabled (#​1840).