ws is a simple to use websocket client, server and console for node.js.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the receiver.js. An attacker can cause memory exhaustion by sending incomplete fragmented WebSocket messages, specifically by transmitting a text frame with FIN=0 followed by multiple continuation frames without completing the sequence, resulting in each fragment being stored as a separate Buffer object with significant overhead.