
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
ultimate-ws
Advanced tools
The Ultimate WebSocket server. ws-compatible server, based on uWebSockets.
The Ultimate WebSocket server. Ultimate WS is an extremely fast, drop-in replacement for ws module, with support for Ultimate Express http upgrades. It uses uWebSockets.js under the hood.
It's useful when:
ws module, but the speed of uWebSockets.jsws to use Ultimate Express insteadnpm install ultimate-ws
ws with ultimate-ws in your codeEcho test using artillery (duration: 20, arrivalRate: 10000):
| Module | Send rate | Mean Session length | Median Session length |
|---|---|---|---|
ws | 2709/sec | 2535ms | 127ms |
ultimate-ws | 10046/sec | 45ms | 12ms |
Since you don't create http server for ws or express, you can't really use server.on("upgrade", ...) to upgrade to Ultimate WS. Instead, you can pass Ultimate Express or uWS app to WebSocketServer as option. So instead of doing this:
const http = require("http");
const express = require("express");
const ws = require("ws");
const app = express();
const wsServer = new ws.WebSocketServer({ noServer: true });
app.get("/", (_, res) => res.send("Hello, world!"));
const server = http.createServer(app);
server.on("upgrade", (request, socket, head) => {
const { pathname } = url.parse(request.url);
if(pathname !== "/wspath") return request.socket.destroy();
wsServer.handleUpgrade(request, socket, head, (ws) => {
wsServer.emit("connection", ws, request);
});
});
server.listen(3000);
You need to do this:
const express = require("ultimate-express");
const app = express();
const { WebSocketServer } = require("ultimate-ws");
app.get("/", (_, res) => res.send("Hello, world!"));
const wsServer = new WebSocketServer({ server: app, path: "/wspath" }); // path is optional
// your usual `ws` server code ...
app.listen(3000);
Ultimate Express is fully compatible, much faster express implementation.
If you want to use Ultimate WS without any existing http server, you can do this:
const { WebSocketServer } = require("ultimate-ws");
const wsServer = new WebSocketServer({ port: 3000 });
// your usual `ws` server code ...
wsServer.on("connection", (ws) => {
ws.on("message", (message) => {
ws.send(message);
});
});
You can also pass existing uWS server to WebSocketServer:
const { WebSocketServer } = require("ultimate-ws");
const uws = require("uWebSockets.js");
const server = uws.App();
const wsServer = new WebSocketServer({ server: server });
// your usual `ws` server code ...
server.listen(3000);
Ultimate WS supports HTTPS. You can pass uwsOptions to WebSocketServer to configure it:
const { WebSocketServer } = require("ultimate-ws");
const wsServer = new WebSocketServer({
port: 3000,
uwsOptions: {
// https://unetworking.github.io/uWebSockets.js/generated/interfaces/AppOptions.html
key_file_name: "path/to/key.pem",
cert_file_name: "path/to/cert.pem",
}
});
Instead of this:
const http = require("http");
const express = require("express");
const ws = require("ws");
const app = express();
const wsServer = new ws.WebSocketServer({ noServer: true, path: "/wspath" });
app.get("/", (_, res) => res.send("Hello, world!"));
const server = http.createServer(app);
server.on("upgrade", async (request, socket, head) => {
// your auth logic
const user = await getUserFromDatabase(request.headers['authorization']);
if(!user) return socket.destroy();
wsServer.handleUpgrade(request, socket, head, (ws) => {
ws.user = user;
wsServer.emit("connection", ws, request);
});
});
server.listen(3000);
You should do this:
const { WebSocketServer } = require("ultimate-ws");
const express = require("ultimate-express");
const app = express();
const wsServer = new WebSocketServer({
server: app,
path: "/wspath",
handleUpgrade: async (request) => {
// your auth logic
const user = await getUserFromDatabase(request.headers['authorization']);
if(!user) {
// request has `req` and `res` properties
// which are instances of `uws.HttpRequest` and `uws.HttpResponse`
request.res.cork(() => {
request.res.writeStatus("401 Unauthorized");
request.res.end();
});
return false;
}
return (ws, request) => {
ws.user = user;
wsServer.emit("connection", ws, request);
}
}
});
app.get("/", (_, res) => res.send("Hello, world!"));
app.listen(3000);
handleUpgrade returns a function, it will be called with the new WebSocket instance and original request. "connection" will not be emitted automatically.false, the connection will not be upgraded. It's your responsibility to destroy the socket.handleUpgrade: undefined), the connection will be handled as usual, and "connection" event will be emitted.All commonly used ws features are supported. Almost all ws servers should work, as it's built with maximum compatibility in mind.
Please refer to ws module documentation for API reference.
Below is the list of supported features and their compatibility:
✅ - Full support (all features and options are supported)
🚧 - Partial support (some features are not supported)
❌ - Not supported
ws options:
sendPingsAutomatically, default true)false, default true)true for DEDICATED_COMPRESSOR_4KB | DEDICATED_DECOMPRESSOR or your own CompressOptions number. Options are not supported and if this is an object it will be treated as true.uWS options (additional options that ws doesn't have):
maxPayload)false)This category only describes server clients. Client-side (new ws.WebSocket()) just uses original ws module, and therefore supports everything.
FAQs
The Ultimate WebSocket server. ws-compatible server, based on uWebSockets.
We found that ultimate-ws demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.