ws: build the Buffer of a text frame, a ping and a pong natively for server sockets by robobun · Pull Request #44112 · oven-sh/bun

robobun · 2026-09-27T10:05:52Z

Problem

A ws server socket converts each text frame twice: ServerWebSocket::on_message (src/runtime/server/ServerWebSocket.rs) builds a string, and #message (src/js/thirdparty/ws.js) encodes it into a Buffer.
In blob mode it emits ping and pong payloads as a Blob, npm ws as a Buffer.

Fix

Handlers that come with onNodeHTTPRequest get their own uWS callbacks. ServerWebSocket::behavior chooses them when set_routes registers the route.
They build a Buffer for a text frame, a ping and a pong, and pass isBinary to message. send() decodes a view in place.
CPU per received text frame: 0.69 to 0.31 µs at 16 B, 3.96 to 1.11 µs at 1 KiB non-ASCII. The public Bun.serve path keeps main's machine code.
Verified: test/js/first_party/ws/ws.test.ts (7 tests fail before), websocket-server.test.ts, module-graph-io.test.ts. Self-reviewed: 22 concerns raised, 19 addressed.

Background

node:http owns a Bun.serve and forwards websocket events to ws server sockets.
uWS binds callbacks to a route. A reload gives an open socket new handlers, so a node:http socket checks their flag per event. Bun.serve: stop leaking a uWS WebSocketContext per route on every reload() #41680 removes that need.
Considered a flag test per message: +17 instructions per Bun.serve message.

Downsides

Release binary: +7,222 B. +45 instructions per binary frame on a ws server socket, up to +4 % per socket.io echo.
blob mode: server on('ping') and on('pong') get a Buffer, as before 1.4.1. The client still emits Blob.
An upgrade through node:http's internal handle (Symbol.for("::bunternal::")) with an own data object gets a Buffer per text frame, not a string.

Notes

Stacked on #44111. With that one merged, this one changes no value that a message listener gets. That holds because uWS rejects a text frame with invalid UTF-8 before the message callback (packages/bun-uws/src/WebSocketContext.h).

No user reported this. The double conversion was found by a read of the code. Its cost shows most for text with a non-ASCII character: there the built-in ws costs more CPU than npm ws on node (3.96 against 3.28 µs per 1 KiB frame, 34.49 against 31.27 µs per 16 KiB frame). The reasons to change it are the repo's performance rules and the two requests on #39808 to build the value natively. No linked issue depends on this PR.

The reference is npm ws 8.21.0 on node v26.3.0: lib/receiver.js#L634-L655 emits a text frame as a Buffer for every binaryType, and #L721 emits the payload of a ping and a pong as a Buffer.

Server CPU per frame, user µs, median of 5 runs, linux-x64 release builds

Frame	Handler	bun 1.4.2	main	base	this PR	node + ws 8.21.0
16 B ASCII text	receive	0.96	0.73	0.69	0.31	1.16
16 B ASCII text	echo	1.75	1.63	1.72	0.53	3.25
16 B non-ASCII text	receive	1.21	0.92	0.75	0.35	1.05
16 B non-ASCII text	echo	2.42	2.15	1.96	0.77	3.37
16 B binary	receive	0.45	0.36	0.37	0.37	1.28
16 B binary	echo	0.53	0.45	0.33	0.31	2.92
1 KiB ASCII text	receive	2.54	2.42	2.48	1.04	2.49
1 KiB ASCII text	echo	3.76	3.69	3.56	2.10	4.46
1 KiB non-ASCII text	receive	3.81	3.94	3.96	1.11	3.28
1 KiB non-ASCII text	echo	5.29	6.84	5.22	2.47	5.55
1 KiB binary	receive	1.27	1.23	1.12	1.14	2.14
1 KiB binary	echo	1.36	1.30	1.20	1.09	4.13
16 KiB ASCII text	receive	19.27	14.65	15.95	10.18	29.37
16 KiB ASCII text	echo	20.86	17.57	18.63	14.24	24.28
16 KiB non-ASCII text	receive	40.13	37.83	34.49	10.38	31.27
16 KiB non-ASCII text	echo	63.32	60.38	56.76	20.68	25.69
16 KiB binary	receive	9.47	9.25	9.87	8.95	32.59
16 KiB binary	echo	12.43	10.95	11.87	12.02	28.99

Method: process.cpuUsage() of the server over 100,000 frames, after 20,000 frames. The peer is a second process that writes masked frames in chunks of 64 KiB, with a mask key that is not zero. The builds run in turn, 5 times. echo is ws.send(data, { binary: isBinary }).
The host was not quiet (load average 250 to 700). One cell moves by up to 30 % between runs. A difference below that is not a result: the binary rows are equal.
The bound: for ASCII text the gain is 2.2x at 16 B and 1.6x at 16 KiB. For non-ASCII text it is 2.1x at 16 B and 3.3x from 1 KiB.

Instructions per event, from the entry of the uWS callback to its return

	main	base	this PR
Public `Bun.serve` handler, 16 B, text / binary / ping	1,084 / 1,105 / 1,073	1,084 / 1,105 / 1,073	1,084 / 1,105 / 1,073
Public `Bun.serve` handler, 1 KiB, text / binary	1,810 / 1,885	1,810 / 1,885	1,810 / 1,885
`ws` `on('message')`, 16 B, text / non-ASCII / binary	2,851 / 3,543 / 1,394	2,838 / 3,530 / 1,392	1,399 / 1,399 / 1,437
`ws` `on('message')`, 1 KiB, text / non-ASCII / binary	4,794 / - / 2,174	4,781 / 23,610 / 2,172	2,179 / 2,249 / 2,217
`ws` `addEventListener('message')`, 16 B, text / non-ASCII / binary	2,851 / 3,543 / 1,394	3,387 / 4,353 / 1,419	1,948 / 2,222 / 1,464
`ws` `addEventListener('message')`, 1 KiB, text / non-ASCII / binary	4,794 / - / 2,174	6,146 / 26,401 / 2,199	4,514 / 5,993 / 2,244
`data.toString()` in the listener, 16 B, text / non-ASCII	3,392 / 4,358	3,377 / 4,346	1,941 / 2,215
echo `send(data, { binary: isBinary })`, 16 B, text / non-ASCII / binary	5,304 / 6,646 / 1,921	5,291 / 6,633 / 1,919	2,701 / 3,351 / 1,964
echo, 1 KiB, text / non-ASCII / binary	-	8,855 / 29,940 / 3,052	5,646 / 8,344 / 3,097
`bench/websocket-server` chat handler, 32 sockets, 16 B	-	33,995	32,556
`ws` `on('ping')`, 16 B	1,513	1,513	1,476

Method: single steps in gdb, after 20,000 events, BUN_JSC_useConcurrentJIT=0, median of 12, stream of one event type, the JS handler included. perf and valgrind are not available where this was built.
The public path: objdump of main and of this PR gives the same instructions for ServerWebSocket::on_message, on_ping, on_pong, on_open, on_close, on_drain, binary_to_js and the six public uWS callbacks. The lines that differ are two absolute addresses of statics. No test or lint holds this property. An edit that reads the flag in a shared body shows in these counts only.
At 16 B, 1,301 of the 1,439 instructions that go were inside Buffer.from(string). So a faster Buffer.from(string) makes the gain for a short frame smaller. For a long frame the gain is the second copy and the second transcoding.
A binary frame: +45. Of these, 7 are in the native function, 2 in the callback (the check for a reload), 25 in the call from native code into JS, 11 in JS. The frame type must go with a binary frame, because in the default binaryType a text frame and a binary frame are both a Buffer. Two other forms of the frame type were measured: the third argument for a text frame only (text 1,406, binary 1,422), and the frame type as this of the handler (1,378 and 1,424). The plain form stays, because the gain is 13 to 21 instructions.
The echo: before the change to normalizeData, an echo of a 16 B text frame cost 4,484 with this PR. normalizeData read data.buffer, and that read makes the ArrayBuffer of a Buffer that the native socket built. It now decodes the view in place.
Where there is no gain. A socket.io echo (socket.io 4.7.1 over the websocket transport): 17,832 to 17,856 instructions after 20,000 messages, 17,800 to 18,055 after 150,000, 21,039 to 21,881 after 5,000. With this PR the echo calls operationNewArrayWithSize, the slow path of a JIT array allocation, 16.0 times for each message. The base calls it 2.7 times. One more small allocation from native code for each message brings the count back to 2.8. This is a property of the allocator, and this PR does not change it. With 32 sockets in the room, the chat handler of bench/websocket-server gains 4 %.

Peak RSS, MiB, smallest and largest of 3 runs, one socket, the listener reads data.length

Frames	base, text	this PR, text	this PR, binary
1,500 of 64 KiB, ASCII	53.5 to 56.1	54.4 to 55.9	52.4 to 55.8
200 of 1 MiB, ASCII	68.7 to 77.5	54.3 to 55.2	53.8 to 56.6
60 of 4 MiB, ASCII	95.9 to 120.7	61.5 to 62.9	61.0 to 66.3
60 of 4 MiB, non-ASCII	88.7 to 97.7	62.5 to 66.9
20 of 16 MiB, ASCII	148.8 to 178.0	104.3 to 120.0	101.7 to 119.1

The string and the Buffer made from it are garbage until the next collection. From 1 MiB a text frame now has the peak of a binary frame.

Sizes

	base	this PR
Cells per text frame, `ws` `on('message')`	3	2
Cells per text frame, `ws` `addEventListener('message')`	6	5
Cells per binary frame, `on('message')` / `addEventListener('message')`	2 / 4	2 / 4
Bundled `ws.js`	39,533 B	39,567 B
Release binary, text segment	80,665,185 B	+7,222 B

New native code (nm -S of the release binary): on_node_http_message 1,503 B, on_node_http_ping and on_node_http_pong 572 B each, two message callbacks of 373 B, ping and pong callbacks of 337 B each. The rest is unwind data and alignment. Host functions: +0. bloaty is not installed.

Self-review, 22 concerns. Not taken:

A PR of its own for the ping and pong payloads. They stay here, because they use the same callbacks. The decision that a maintainer must take is below.
A source lint that holds the public path free of the flag.
A new file in bench/. The chat benchmark there has 1 receive for 32 sends and cannot show this change.

For a maintainer to decide

Ping and pong in blob mode. ws: one binaryType rule for both shim sockets, add binaryType "blob" to ServerWebSocket #39808 made binaryType native and left this as its open question: 1.4.0 emitted a Buffer, 1.4.1 and 1.4.2 emit a Blob. This PR goes back to a Buffer for the server socket, as npm ws does. The client socket still emits a Blob, so the two sockets differ until the client changes. ws: differences from npm ws that remain on the built-in client and server sockets #44108 has the row.
The bridge. #message still takes a string with no frame type, for a server socket that gets its events from a public Bun.serve. The adapters that a code search for ::bunternal:: finds used that path up to Bun 1.2.5. On a current build their handleUpgrade call fails before any event. A bridge written for the current layout works, and one test holds its values. If this is not a contract, the branch and the test can go.

The first form of this PR tested the flag for each message inside on_message, on_ping and on_pong. Each message of a public Bun.serve server paid for it: +17 instructions (text), +14 (binary), +8 (ping). Two forms on the way to this one did not hold:

on_message as a const generic function. The instance for the public path went to another codegen unit, binary_to_js lost its argument promotion, and a public binary message cost +3 instructions. So the public functions are not generic: they are wrappers of one #[inline(always)] body.
The check for a reload inside on_node_http_message. LLVM then did not inline Corker::run there: +37 instructions for each message of a ws server socket. So the check is in the callbacks of NodeHTTPServerWebSocket.

The flag. ServerConfig::from_js stamps HandlerFlags::NODE_HTTP on the handlers that arrive with onNodeHTTPRequest. The flag says how a set of handlers is called, so it comes from the options that brought the handlers. The server kind is not the flag: under --hot a node:http server can become a Bun.serve server, and is_node_http_server stays set. reload() parses the new options again, and adopts the handlers with their flags, as it does for publishToSelf. set_routes runs again after a reload and chooses the callbacks of the new routes from the new flag.

A socket that stays open over a reload keeps the callbacks of the route that opened it, and gets the handlers of the new options. Two tests cover it. The first calls reload() in the process and looks at message, ping and pong. The second runs --hot: generation 0 and 1 are node:http with ws, generation 2 is Bun.serve on the same port. With the check removed, the Bun.serve handler gets a Buffer and 3 arguments on the socket that stayed open.

Order with #41680. #41680 gives a server one shared uWS websocket context, and each ws() call writes the callbacks into it. Then a socket that stays open gets the callbacks of the new routes, and the check for each event has no use. The two PRs edit the same three app.ws() lines in src/runtime/server/mod.rs. The one that lands second passes both the context and the key, deletes has_node_http_handlers() and the three branches in NodeHTTPServerWebSocket, and keeps the two reload tests.

Landing frame. The nine uWS callbacks share ServerWebSocket::land: the reborrow, the context of the handlers, and the fold of what a handler left pending. module-graph-io.test.ts now has the message, ping and pong listeners of a ws server socket in its matrix of errors.

Alternative: resolve ws to the npm package. node:http gives a real upgrade socket to the server and to the client since #31587 and #43557, so npm ws runs on Bun. On main ad60a9b, npm ws 8.21.0 passes 428 of its own 435 tests (node v26.3.0: 435). The 7 failures are not in the websocket path: fs.openAsBlob (3), https.Server.emit('connection', socket) (3), maxHeadersCount (1).

Server CPU per frame, user + system µs, median of 3 runs on a busy host:

	built-in, main	npm ws on Bun	npm ws on node
16 B text, receive	0.84	1.20	0.87
16 B text, echo	1.36	5.90	7.53
1 KiB text, echo	5.16	9.90	10.29
1 KiB non-ASCII text, receive	3.92	2.72	4.44
1 KiB binary, receive	1.29	2.66	2.57
1 KiB binary, echo	1.81	13.26	11.54
16 KiB non-ASCII text, echo	65.51	50.74	45.50

npm ws writes to the socket one time for each frame. The built-in sends the frames of one read in one write. RSS for each idle connection is equal: 10.4 to 11.1 KB. #36102 proposes this shape for undici: the installed package first, the built-in as fallback. For ws that is a decision for a maintainer, because it costs the send path. This PR has a value only while ws resolves to the built-in.

Not in this PR. #44108 tracks these: the reason argument of on('close') is a string (npm ws: a Buffer), the client socket emits a text frame as a plain Uint8Array in arraybuffer mode and ping and pong payloads as a Blob in blob mode, send(view, { binary: false }) decodes the bytes into a string that the native socket encodes again, and skipUTF8Validation has no effect.

Open branches. #36650 (maxPayload) edits #message and the websocket options of node:http. After a rebase its size check stays, and message is a Buffer, an ArrayBuffer or a Blob, never a string. It reloads the websocket options together with onNodeHTTPRequest, so the handlers keep the flag. Work on top of #34661 adds the same bit of HandlerFlags under another name. The one that lands second reads the flag that exists.

robobun · 2026-09-27T10:07:30Z

Status: ready for review, after #44111.

The base of this PR is the branch of #44111. When #44111 merges, this PR moves to main.

How to see the change: on a ws server socket with binaryType = "blob", on('ping') gets a Blob before and a Buffer after, as on node v26.3.0 with ws 8.21.0. For text frames the values that listeners get do not change. The numbers in the description are the change.

The --hot test holds the public handler: a node:http server with ws, edited into Bun.serve on the same port, must give message(ws, message) a string and two arguments. That is also true for a socket that stayed open over the edit.

claude

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Beyond the inline findings, I also traced HandlerFlags::NODE_HTTP through reload(): on_reload (src/runtime/server/server_body.rs:2132-2141) adopts the freshly parsed websocket handler with the flags ServerConfig::from_js stamped on it, so the flag follows the new options rather than the server kind, and the &arguments[..2] slice keeps public Bun.serve handlers on the 2-arg contract.

Extended reasoning...

The change moves npm-ws payload shaping for node:http server sockets from src/js/thirdparty/ws.js into ServerWebSocket.rs behind a new NODE_HTTP handler flag set in ServerConfig.rs; it touches no auth, crypto or injection surface. Two inline findings (a behavior change for apps upgrading through the ::bunternal:: handle, and a --hot fixture that hangs rather than fails) already signal a human look, so this note only records the reload-path check that was ruled out.

robobun · 2026-09-27T10:45:43Z

^{Updated 10:16 AM PT - Sep 29th, 2026}

✅ @robobun, your commit 008e5cea8cee2e9600ba7372dfd777fbf6731352 passed in Build #121630! 🎉

🧪 To try this PR locally:

bunx bun-pr 44112

That installs a local version of the PR into your bun-44112 executable, so you can run:

bun-44112 --bun

claude

Code review found no issues

No high-confidence issues detected in this change.

Still open from earlier reviews (1):

Unresolved: 1 minor or pre-existing.

robobun · 2026-09-28T19:55:58Z

@robobun wake up!!

Jarred-Sumner · 2026-09-28T20:40:36Z

@robobun wake up!!

robobun · 2026-09-28T20:51:57Z

Status of this PR: the next push changes its design. The pre-merge check asked if the public Bun.serve path can keep its instruction count. It can.

ServerWebSocket::behavior chooses the uWS callbacks one time, when set_routes registers the route. Handlers that came with onNodeHTTPRequest get callbacks of their own. The callbacks of a public handler read no flag.

Instructions for each 16 B event, from the entry of the uWS callback to its return (release builds, linux-x64, gdb single steps, after 20,000 events, median of 12):

	main	current head `6945fdf911`	next push
Public `Bun.serve` handler, text	1,084	1,101	1,084
Public `Bun.serve` handler, binary	1,105	1,119	1,105
Public `Bun.serve` handler, ping	1,073	1,081	1,073
`ws` `on('message')`, text	2,851	1,406	1,399
`ws` `on('message')`, binary	1,394	1,442	1,437

ServerWebSocket::on_message, on_ping, on_pong, binary_to_js and the three public uWS callbacks disassemble equal to main. Only two absolute addresses differ.
Price: the release binary grows by 7,236 B. The current head adds 324 B.
A reload replaces the handlers of a socket that stays open. So a socket that a node:http route opened checks the flag of its current handlers for each event. The --hot test now keeps a socket open over two reloads. It fails with a Buffer and 3 arguments when I remove that check.
A binary frame on a ws server socket costs 45 instructions more than on the base, which is the price of the third argument. I measure a form that passes the frame type for a text frame only.

Build 121222 is red by test/js/bun/dns/resolve-dns.test.ts on darwin aarch64 only. This diff does not touch that test.

The self-review of the new diff is in progress. I push when it ends.

claude

I re-reviewed the three commits pushed since my last pass and didn't find any bugs; since this adds a second uWS handler type over unsafe pointer casts in the websocket hot path and changes what ws server sockets receive for ping/pong in blob mode, a human look is still worthwhile.

What was reviewed:

NodeHTTPServerWebSocket wrapper: #[repr(transparent)] over ServerWebSocket, and Wrap only uses the user-data pointer set at upgrade, so the this.cast() delegation for open/drain/close is sound.
--hot in both directions: reload re-runs set_routes, so new connections pick the wrapper from the reloaded handler's flags; already-open sockets keep the old uWS context, which is why the per-event has_node_http_handlers() check is needed (node:http to Bun.serve), and the reverse direction lands on the base on_message whose string payload the shim's isBinary === undefined fallback still wraps.
HandlerFlags::NODE_HTTP survives reload: on_reload_from_zig uses flags.set(SSL, ...) rather than overwriting, and node:http passes onNodeHTTPRequest on every generation so from_js re-stamps it.
Plain Bun.serve handlers: the non-NODE_HTTP const-generic path builds the same 2-element args array as before; the websocket-server.test.ts assertion now pins arguments.length === 2.

Extended reasoning...

The change spans the Rust websocket server (ServerWebSocket.rs, ServerConfig.rs, WebSocketServerContext.rs, mod.rs), the ws shim and node:http bridge in src/js, a private type declaration, and two test files. It touches no auth, crypto, or input-validation surface; the payload conversions use the existing ArrayBuffer::create_buffer and binary_to_js helpers. Deferring rather than approving because the diff introduces a new unsafe WebSocketHandler impl on a hot path with reload-dependent dispatch, ships a user-visible change (ws server sockets in blob mode now get a Buffer for ping/pong), one of my earlier inline notes about the Symbol.for bridge remains open, and a maintainer comment landed after the last push whose content I cannot see.

claude

Code review found no issues

No high-confidence issues detected in this change.

robobun · 2026-09-29T15:29:43Z

Outcome of the self-review of the new form, as the description promised. It raised 22 concerns. Head 0af6b2ea4e has the changes.

Changed in the code

send(view, { binary: false }) decodes the view in place. Before, normalizeData read data.buffer, and that read makes the ArrayBuffer of a Buffer that the native socket built. An echo of a 16 B text frame cost 4,484 instructions with the first push of this form. It costs 2,701 now (base: 5,291).
The nine uWS callbacks share one landing frame, ServerWebSocket::land. The public callbacks still disassemble equal to main.
New tests: what the handlers of node:http get from the native socket (4 rows, one over TLS), reload() with a socket that stays open (message, ping, pong), the view kinds of send(), and the ws listeners in the error matrix of module-graph-io.test.ts. 7 tests of ws.test.ts fail on the base.

Changed in the description

CPU time for each frame against 1.4.2, main, the base and node with npm ws, for ASCII and non-ASCII text and for binary frames, at 16 B, 1 KiB and 16 KiB. Peak RSS for large frames.
Where there is no gain: a socket.io echo.
The order with Bun.serve: stop leaking a uWS WebSocketContext per route on every reload() #41680.

Corrections to what I wrote before

In the review thread on _http_server.ts I wrote that the adapters found by a code search pass the handle of the ws shim, and that the shim takes their string as before. That is not correct for a current build. Those adapters used the path up to Bun 1.2.5. On main, on the base and on this PR, their handleUpgrade call fails with socket.removeListener is not a function before any event. Only a bridge written for the current layout reaches #message.

For a maintainer to decide

Ping and pong payloads in blob mode. ws: one binaryType rule for both shim sockets, add binaryType "blob" to ServerWebSocket #39808 left this as its open question. 1.4.0 emitted a Buffer, 1.4.1 and 1.4.2 emit a Blob. This PR emits a Buffer on the server socket, as npm ws does. The client socket still emits a Blob. If you want the two sockets to change together, I move the ping and pong part out of this PR.
The bridge branch in #message (a string with no frame type, from a public Bun.serve). No program that I found depends on it on a current build. If it is not a contract, I remove the branch and its test.

Not taken

A source lint that holds the public path free of the flag.
A new file in bench/. The description gives the method of each number.

claude

Code review found no issues

No high-confidence issues detected in this change.

…ffer built natively The websocket handlers that node:http gives to Bun.serve get what npm ws emits: a Buffer for a text frame, a ping and a pong, made from the wire bytes, and isBinary as a third argument of message. The shim emits them as received. A text frame no longer becomes a JS string that the shim turns into a Buffer. The flag is stamped on the handlers that arrive with onNodeHTTPRequest. The public Bun.serve message handler is unchanged: a string, two arguments.

…test fast The server socket keeps taking what the handlers of a Bun.serve() get, a string for a text frame and no frame type, from a bridge that is not node:http's.

…istered Handlers that came with onNodeHTTPRequest get uWS callbacks of their own. The callbacks of Bun.serve() handlers read no flag for a message.

… place, tests of the native payloads The callbacks of ServerWebSocket and of NodeHTTPServerWebSocket share one landing frame. normalizeData() no longer reads the buffer of a view: that read made the ArrayBuffer of a Buffer that the native socket built. New tests look at what the handlers of node:http get from the native socket, at a reload() with an open socket, and at errors of ws listeners inside a Bun.ModuleGraph.

robobun · 2026-10-03T04:23:52Z

The slow path calls that this PR's Notes describe ("Where there is no gain": 16.0 calls of operationNewArrayWithSize for each socket.io message) have their cause in JavaScriptCore, and oven-sh/WebKit#767 proposes a fix.

DFG and FTL allocate the storage of an array with a run-time length of 0 or 1 (a rest parameter with 0 or 1 arguments, new Array(n), slice, map) from the 16-byte size class. Their slow path took 48 or 32 bytes from another size class, so it never refilled the free list that the inline path reads.
Buffer.from(string) refilled that free list as a side effect, once for each frame. That is why the count went up when this PR removed it.
With the WebKit change, a socket.io echo on main goes from 82,671 to 2,860 such calls for 30,000 messages. The number for this branch needs a build of it with that WebKit.

Jarred-Sumner · 2026-10-14T10:06:31Z

This is Claude, working with Jarred on consolidating the open WebSocket PRs.

Superseded by #45223 (reworked into the server transport).

The useful idea is kept: a second WebSocketHandler implementation, so that Bun.serve's callbacks keep their machine code. It is WsPackageSocket in ServerWebSocket.rs: message(Buffer, isBinary), ping(Buffer), pong(Buffer), drain(), close(code, Buffer), with the ws object as this.

Not needed any more: HandlerFlags::NODE_HTTP and the per-event has_node_http_handlers() re-check. Each set of WebSocketServer options has its own uWS context, so the callbacks are chosen when the context is made.

Also dropped: the isBinary === undefined bridge branch and the land() refactor of all nine callbacks.

On the numbers: I measured 0.27 µs for a 16 B text frame against 0.15 for binary, and 1.05 against 0.78 at 1 KiB. The direction of the claim holds; 2.2x is more than I saw.

Tests: ws-server-compat-receive.test.ts (a text frame is a Buffer in all four binaryTypes; ping and pong too).

…n native transports (consolidates the open WebSocket PRs) (#45223) ### What does this PR do? This PR replaces the open WebSocket pull requests (listed in the table at the end) with one change. It covers the global `WebSocket` client, `Bun.serve({ websocket })`, the built-in `ws` package, the parts of `node:http` that `ws` depends on, undici's WebSocket exports, and the types, docs and tests for all of them. I treated every open PR as a bug report. For each one I reproduced the bug on main, ran the same script on Node 26.3 (undici) and on npm `ws`, checked the RFCs, and then wrote the fix the way the code should have been structured in the first place. Often that meant deleting a mechanism that caused several bugs at once. Many fixes below had no PR. They came out of those comparisons and are marked "(no PR)". Size: native and builtin source outside `ws` is +5,893 / -5,374. `ws.js` (1,744 lines) becomes `ws.ts` (3,399 lines, about 450 of them types). Tests are +22,739 / -1,786. How I decided close calls: - `require("ws")` behaves like npm `ws` on Node. - The global `WebSocket` behaves like the WHATWG spec and Node's global. Bun's extras stay. - `Bun.serve` follows RFC 6455 / 7692 on the wire and does what its docs and types say. ### Behavior changes to look at first These are the changes I expect users to notice. They're listed so that any of them can be vetoed. **Global `WebSocket`** 1. **Real closing handshake.** Before, `close` fired about 0.2 ms after the `close()` call with our own code and `wasClean: true`, no matter what happened next. Now `close()` sends the Close frame, sets `readyState` to CLOSING and keeps the process alive. Once both Close frames are exchanged, the client closes its side (FIN, close_notify), and `close` fires **when the connection closes**, as in Node (undici and npm `ws`) and browsers. The event has the **server's** code and reason (1005 if its frame was empty) and `wasClean: true`. - If the server echoes the Close frame but never closes the connection, the client drops it at the timeout. The close is still clean and still has the server's code. - If the connection ends before the server's Close frame, or that frame doesn't arrive within `BUN_CONFIG_WS_CLOSE_TIMEOUT`, the result is `1006`, not clean. The timeout is 30 s, in practice 32 to 36 s because uSockets sweeps every 4 s. - Cost: a script that ends in `ws.close()` exits one round trip later. If the server never answers, the process stays alive until the timeout. `terminate()` and `process.exit()` are the ways out. npm `ws` also waits 30 s; undici waits forever. - Data queued before `close()` still goes out first. The timeout starts over whenever more of it can be written, so a slow upload isn't cut off (100 MB at 2 MB/s arrives whole, also through a proxy), and a peer that stops reading is dropped one timeout after its last read. Progress means the kernel reports the socket writable: on loopback with the default 30 s, a reader at 20 KB/s counted as stalled and one at 50 KB/s didn't. main waits forever. - Two tests from #44618 pinned the old model on purpose. I rewrote them. 2. **`close()` without a code sends an empty Close frame**, and both ends report 1005, as in browsers, Node and npm `ws`. A `Bun.serve` `close(ws, code)` handler now sees 1005 when a Bun client calls `close()`. When the server closes first, the client echoes what it received: 1001 stays 1001, empty stays empty. 3. **One failure path.** Whenever the client fails the connection (bad handshake, TLS, proxy, protocol error, message too big, invalid UTF-8, bad close code), it fires `error`, then `close` with **1006**, reason `""`, not clean. Before, `close` had 1002 / 1007 / 1009 / 1011 / 1015 with an English reason, sometimes `wasClean: true`, and often no `error` fired. The text is now in `ErrorEvent.message`, and `ErrorEvent.error.code` is new (`ECONNREFUSED`, `ENOTFOUND`, `DEPTH_ZERO_SELF_SIGNED_CERT`, `ERR_TLS_CERT_ALTNAME_INVALID`, `WS_ERR_INVALID_UTF8`, ...). If the failure happens after open, the client sends a Close frame with 1002 / 1007 / 1009 first. Losing the TCP connection after open isn't a failure: only `close` 1006 fires, with reason `""` (was "Connection ended"). 4. **The 101 response is validated strictly.** The connection fails if the server picks an extension or permessage-deflate parameter that wasn't offered or is invalid (RFC 6455 9.1, RFC 7692 7.1). That includes a server that echoes `client_max_window_bits` without a value. A response head over `--max-http-header-size` + 1 KB now fails no matter how TCP splits it into reads. Before, a head of about 17 KB or more got through if it arrived in one read. 5. **Header values are sent one byte per code unit**, like `fetch` and Node: "café" is `63 61 66 e9` (was UTF-8). `Host` / `Proxy-Connection` in `proxy.headers` replace Bun's own line in the CONNECT request. `fetch` shares that writer, so this changes `fetch` too. 6. `terminate()`, a failed connection and the close timeout now close with a FIN instead of a RST. The kernel still sends a RST if data is unread. The client answers a peer's FIN with a FIN. 7. Messages that arrive together with the 101 are delivered after `open`'s microtasks, as in browsers and undici. npm `ws` has the old order, so `ws` on Bun now differs from it there, in the harmless direction. 8. Smaller changes: - An invalid `binaryType` is ignored (used to throw). - `ws.url` is `ws:` / `wss:` when the input was `http:` / `https:`. - `MessageEvent.origin` is the origin, not the URL with its password. - `bufferedAmount` no longer drops to 0 at close. - `send(Bun.file())` throws (used to send an empty frame). - A ping or pong that nothing listens for is dropped. It used to be queued for a later listener, so a flood of them grew memory to gigabytes. Automatic pongs are unaffected. - Interim 1xx responses count toward the response head's size limit (`--max-http-header-size`). An endless stream of `100 Continue` used to freeze the event loop. **`Bun.serve({ websocket })`** 9. **`websocket.error` is called as `(error, ws)`** and is now typed. It used to be called as `(error)`, so existing handlers keep working and new ones can tell which socket failed. The docs said `(ws, error)`, which never matched the implementation. They now say `(error, ws)`. 10. **`server.stop(true)` closes each WebSocket with 1001 "Server closed"**, including through `using server`. The client and the `close` handler used to see 1006. `stop()` is unchanged. 11. A long `ws.close(code, reason)` reason is cut at 123 bytes on a character boundary. It used to be cut mid-character, so the client saw 1007. Every numeric code is still accepted and sent as before. 12. **`server.upgrade()`**: - reads the handshake from `req.headers` only; - returns `false` once a `Response` has been accepted for the request; - throws for a `Request` that another server received; - ignores `Upgrade`, `Connection`, `Sec-WebSocket-Accept / -Key / -Version / -Extensions`, `Content-Length` and `Transfer-Encoding` in `options.headers`; - treats an empty `Sec-WebSocket-Protocol` in `options.headers` as declining the subprotocol. - Related: an HTTP/1.1 Upgrade or CONNECT request without `Host` gets a 400 (node:http is unchanged). 13. **The configured compressor is actually used.** Every `compress: "dedicated"` / `"4KB"`...`"256KB"` setting ran as `"3KB"`. Each now uses the window its name says, which costs memory. Per connection after traffic: `"dedicated"` 149 → 282 KB, `"128KB"` → 218, `"64KB"` → 186, `"16KB"` → 154. Off, `true` and `"shared"` stay at 2 KB. `"3KB"` is what every setting used to run as. The libdeflate compress fast path is removed (because of the Safari bug described below; numbers are under Performance). `x-webkit-deflate-frame` (Safari 14 and older) is no longer accepted, so those clients run uncompressed. A dedicated compressor accepts and echoes an offer of `server_max_window_bits=8`, as npm `ws` does. The shared compressor (the default) is always 15 bits, so it declines a smaller window, and so does any offer that also has `server_no_context_takeover`. Those connections run uncompressed. Released Bun answered it with 9, which the RFC doesn't allow. (zlib deflates with 9 bits, and that output always inflates with an 8-bit window.) 14. When the server fails a connection, the client now gets a Close frame with 1002 / 1007 / 1009 and the reason. The `close` handler still gets `1006`, but its reason is never empty now. The socket then stays open until the peer's FIN arrives, or for 4 to 16 s. 15. `idleTimeout: 0` arms no timer, so there are no automatic pings either. Those connections used to die at about 256 s. 16. **`maxPayloadLength` no longer applies to Ping, Pong and Close frames.** They have their own 125-byte limit. 17. The error messages of `ServerWebSocket` methods are now consistent with each other. A closed socket still ignores the call, whatever the arguments are. 18. A throw after `server.upgrade()` is no longer swallowed. It goes to `error()` or stderr, the server keeps serving, a surrounding `bun test` fails, and the process exits with code 1 when it ends naturally, same as for any printed `fetch` error. This holds for a sync `fetch`, and for an async one that was really suspended (a timer, I/O) before it called `upgrade()`. If an async `fetch` upgrades before its first real suspension and then rejects, that is still an unhandled rejection and ends the process, as on main. 19. After `server.reload()`, the new `websocket` options also apply to sockets that are already open. The handlers already did. **`ws`** 20. `'error'` gets an `Error` (was an `ErrorEvent`) and is **fatal without a listener**, as in Node. A failed connection attempt, or on a server a hostile frame, ends a process that has no `'error'` listener. 21. `'close'` is `(code, reason: Buffer)` (was a string plus a third argument). It fires when the connection closes, or at `closeTimeout`. Failures are 1006: `'error'` fires immediately and `'close'` when the connection closes, as in npm. (The global `WebSocket` fires both immediately, as undici does.) `close()` without a code gives 1005. `'unexpected-response'` is not followed by `'close'`. 22. A text message is a `Buffer` for every `binaryType`. 23. `ws` servers have no idle timeout, no automatic pings and no backpressure limit. They used to inherit 120 s, a ping at 104 s and 16 MiB from `Bun.serve`. - Automatic Pongs are the one thing still capped at 16 MiB, because the peer controls how many there are. They're skipped while that much is buffered for the socket (RFC 6455 5.5.3; npm queues them all). The cap applies on every transport and also to the clients (`ws` and the global `WebSocket`), which had no cap on main. - The default `maxPayload` is 100 MiB (was 16). - uWS no longer preallocates the whole length a frame header announces before the bytes arrive. It preallocates at most 16 MiB. This also applies to `Bun.serve` with a large `maxPayloadLength`. 24. `WebSocketServer({ perMessageDeflate })` actually negotiates permessage-deflate, and `ws.extensions` is a string. The uWS workaround for Safari 15.0-15.3 no longer applies to `ws` on node:http (npm `ws` has none). `Bun.serve` keeps it. 25. **With an `HttpsProxyAgent`, each hop is verified with its own TLS options**, as on Node. The agent's options (`rejectUnauthorized`, `ca`, ...) apply only to the connection to the proxy, and the WebSocket's options only to the target. Before, both sets were merged and used for both hops, so `new HttpsProxyAgent(url, { rejectUnauthorized: false })`, meant for a self-signed proxy, also turned off certificate checks for the **target**. Code that relied on that has to pass the option to `new WebSocket(...)` too. - All 42 combinations I measured on Node with the real `https-proxy-agent` (14 sets of options, for http→wss, https→ws and https→wss) now give the same result. - The native client gets a new option for this, `proxy: { url, headers, tls }`, also on the global `WebSocket`. With `proxy.tls` (even `{}`), the proxy hop uses only `proxy.tls` and the target only `tls`. Without it, `tls` applies to both hops as before. `serverName` and `checkServerIdentity` are never shared: `tls`'s are for the target and `proxy.tls`'s for the proxy. Proxy agents stay on the native client. - `proxy.tls: true` means `{}`, falsy values mean "not set", and any other non-object throws. `pfx` works in it. - An agent that has neither `connectOpts` nor `proxyRequestOptions` gets no `proxy.tls`, so it behaves as on main. With credentials in an agent's proxy URL, they win over a `Proxy-Authorization` header, as in `https-proxy-agent`. - `'error'` gets the value `checkServerIdentity` returned, as in Node. It used to get a generic TLS error. If the proxy can't be reached, `'error'` names the proxy, not the target. 26. Smaller changes: - A client stays CONNECTING when an `'upgrade'` listener throws, as in npm. It used to emit `'open'`. - A client no longer fails on a `Sec-WebSocket-Version` response header, a repeated `permessage-deflate` entry, or window bits written like `015` or `0xf`, all of which npm `ws` accepts. - `send()` while CONNECTING throws. - `ws.url` is `undefined` on server sockets. - `on*` / `addEventListener` are built on the emitter, as in npm: they use ws's own event classes (not `instanceof Event`), `addEventListener("upgrade")` does nothing, and the `signal` option is ignored. - A server socket is `instanceof WebSocket`. - After `'open'`, only protocol errors are `'error'` events. A reset, a broken TLS record or a failed renegotiation is just `'close'` 1006, as in npm and on main. **Differences from npm `ws` that I kept** (veto any): - An invalid close code throws and leaves the socket OPEN. That matches ws 8.22.0. 8.18.3, the version in `test/node_modules`, leaves it CLOSING forever. - A header whose value is an array is sent as one line joined with ", ". npm sends one line per element. Both join `cookie` with "; ". - `mask: false` / `generateMask` are ignored, `binaryType: "fragments"` gives one fragment, and the `Sender` / `Receiver` classes throw. - After a native upgrade, `req.socket.pause()` doesn't stop reads (`ws.pause()` does), and `req.socket` emits no `'end'`. - `terminate()`: on a server, `'close'` fires before the callbacks of sends made after `terminate()`. On a natively connected client, data that is already buffered is delivered during `terminate()`, not after it returns. `terminate()` in a `'message'` listener drops the rest of the packet being parsed. - A `'message'` listener that throws doesn't stop later messages (npm's receiver stalls). `addEventListener("ping" | "pong")` works. - A Close reason that isn't valid UTF-8 is sent with U+FFFD (npm sends the raw bytes). If that makes it longer than 123 bytes, `close()` throws `RangeError` and the socket stays OPEN. - After the body of a non-101 response, the client closes the connection (Node keeps it for its agent). - `send()` of a file-backed `Blob` throws (npm reads it asynchronously). - Pings aren't answered while more than 16 MiB is buffered for the socket (npm queues a Pong for each, with no limit). - A frame that breaks two rules at once (say RSV2 set and unmasked) is rejected with Close 1002 like in npm, but `'error'` may name the other broken rule. Frames that break one rule get npm's exact error. Released Bun emits no `'error'` and sends no Close frame for any of them. - On a paused, natively connected client, bytes that arrive after `pause()` stay in the kernel's buffer, so `terminate()` and the close timer drop them. Node has already read them and delivers them. - A paused native socket (client or server) doesn't read, so it doesn't see the peer's FIN until `resume()` or `terminate()`. That includes a `createWebSocketStream()` whose consumer has stalled. Node keeps reading up to 64 KiB while paused, so it sees a FIN that follows little or no data. - `req.destroy()`, `req.abort()` or an aborted `signal` inside an `'upgrade'` listener of a natively connected client fails the handshake: `'error'`, then `'close'` 1006. Node emits `'open'`, then `'close'` 1006. I tried Node's order and took it out again: it leaked the connection when a listener threw. - `req.setTimeout()` does nothing on a natively connected client, so an `'unexpected-response'` listener can't change or turn off `handshakeTimeout`, which stays armed until the body ends. Until the response head is complete, `handshakeTimeout` is a fixed deadline that interim responses don't restart. - On a server, send callbacks that are still waiting when the closing handshake finishes run when the connection closes, right before `'close'`, not at the moment of the flush: with no error if the kernel took everything, else with `ERR_STREAM_DESTROYED`. `readyState` is already CLOSED there. On TLS, a drain can report success while uSockets still holds the last record. - If a send callback throws, the ones queued behind it still run, each once. Node drops some of them, depending on how the writes were batched. - `ws.send()` followed by `ws._socket.destroy()` in a `'message'` or `'ping'` listener of a server drops that message. `terminate()` and `close()` deliver it. - Through a proxy, the request passed to `finishRequest` emits no `'socket'` event before `end()`. The native client connects with the final headers, so there is no socket yet. **Not taken**: - #35031 (WHATWG-only close codes): breaks `close(1001)` / `close(1011)`, which work today, with no gain for portable code. - #41712 (env proxy by default): a product decision, stays open. - #36749 (serialize async `message` handlers). - #39255 (keep the ping deadline across sends): TCP already notices a dead peer, and it could drop a slow one that is alive. - #44122, #20533, #37559: refactors. - #35730, #36561: speed-ups of tests that CI skips. - #31205: can't be reproduced. Also not here: - `closeOnBackpressureLimit` over TLS still takes about 12 s to close. It's an old bug, and the fix changes EOF routing in the TLS engine. - `ws.remoteAddress` can still be `undefined` when it's first read inside `close()`. Filling it in eagerly costs a `getpeername` per connection. The docs say to read it while the socket is open; the value is kept after that. - Throws inside `websocket.*` handlers are routed the way they are today. - The `ws` client option `secureContext` is honored on direct connections but still ignored when connecting through a proxy (same as before this PR). ### Changes #### Global `WebSocket` (client) The connected client now tracks two flags (our Close frame was sent, the peer's Close frame was received) and has one exit, `finish()`. The C++ side has one `finish()`, one constructor path and one `sendFrame()`. That replaces six dispatch sites, three copies of the failure block, a 130-line switch and 14 `send` / `ping` / `pong` overloads. Crashes, hangs, lost data: - `send(); send(); close()` lost data. On `ws://` the socket was shut down in both directions right after the Close frame, so anything the server sent next triggered a RST that also destroyed unsent bytes. A plain echo server got 10 of 32 small messages (2 of 32 at 64 KiB) while the client reported `1000`, clean, and 50 ordinary closes caused about 50 RSTs. Now nothing is shut down after the Close frame, and the FIN is sent once both Close frames are exchanged: 32 of 32 in each case, including when the script just ends. (#45196) - `close()` with unsent data queued and a peer that stopped reading never finished, and `terminate()` was a no-op in CLOSING, so the process hung forever. The timeout is now armed when the Close frame is queued. `terminate()` works in every state except CLOSED and reports a close code that was already received. (#36112; the timeout: no PR) - A server's Close frame that arrived under send backpressure left `readyState` OPEN, and later `send()`s were queued behind our own Close echo. (#36112) - A send queue whose tail landed on the end of its ring buffer never flushed the wrapped part (`bufferedAmount` stuck at 7). (#44821) Growing such a queue blocked `send()` for 2.9 / 11.4 / 43.6 s at 16 / 32 / 64 MB. `LinearFifo::realign` is now one `rotate_left`. (no PR in this set; #44929 touches the same function) - `wss://` through a proxy: Close and Pong frames overtook queued messages (`BIN x185, CLOSE, BIN x71`), so 71 of 256 messages were lost behind a "clean" close. (#44822) - A masked Ping, Close or continuation frame from a server was parsed with the mask key as payload, and the connection continued out of sync. Any masked frame now fails the connection. (no PR) - `permessage-deflate; client_max_window_bits=8` was accepted, and then the first compressed message failed with `1011 "Compression not implemented yet"`. (#38632) - `send()` / `ping()` / `pong()` of `Bun.file()` or an S3 file silently sent an empty frame. They now throw `ServerWebSocket`'s error, in every state. (#39082) - A detached buffer hit `ASSERTION FAILED: m_ptr` on debug builds. It's now an empty payload, as in WebIDL, `ServerWebSocket`, `Blob` and `Response`. (#35029, without its TypeError) - `new WebSocket(url, ["ÿ".repeat(357913942)])` aborted the process. (#42216, reduced to the one call site that expands its input) - Deleted `EncodedSlice::utf16_global`, a safe fn that marked a borrowed slice as "C++ frees this". Text frames now reach C++ as an owned string. Fixes #31968. (#31982) - `pause(); close()` kept the fd open (on TLS the server's too) until the timeout. Closing now resumes reading. `ws` is the exception: there the socket stays paused, as in npm. (#42974) Events and state: - Every failed connection fires `error`, then `close` 1006. Subprotocol mismatches used to give `close 1002 ... wasClean: true` and no `error`. (#45122) Failures after open do the same and send a Close frame first. Before, 22 kinds of bad frame reset the TCP connection and reported 1002 / 1007 / 1009 / 1011 without `error`. RSV1 without the extension was `1011`, "clean". An illegal close code from the server was `1002`, "clean". Corrupt deflate data was 1002 and is now 1007. (no PR) - Errors have `error.code`, and the message includes the detail: `Expected 101 status code: 503`, `TLS handshake failed: self signed certificate`, `Proxy connection failed: 403 Forbidden`. (no PR) - A connect failure detected synchronously (a missing unix socket) left `readyState` at 3 right after the constructor and put the whole sentence, URL included, in `close.reason`. It now looks like an asynchronous failure and reports `ENOENT`. (no PR) - The automatic Pong is sent before the `ping` event fires and never after our Close frame. Before, `close()` in a `ping` listener on `wss://` sent an empty Pong after the Close. (no PR) - Events run in the `AsyncLocalStorage` context of the `new WebSocket()` call, as in Node. Sockets created inside a `Bun.ModuleGraph` get their store too. The snapshot leaves out the graph's own frames, so an open socket doesn't keep its graph alive. (#33066) - Frames that arrive with the 101 wait for `resume()` if the socket was paused in `open` or earlier (#43018), and are delivered after `open`'s microtasks (#43696). This takes one field, with no native microtask and no special cases for nested event loops. - `isPaused` is false, and `pause()` / `resume()` return false, unless the socket is CONNECTING or OPEN. (#42978) - After the connection closes, `bufferedAmount` keeps the bytes that were never sent, and then grows only by the payload bytes of later `send()` calls. It used to count framing and pings and skip Blobs. This is what #31760 (already closed) asked for. (#31761, as one snapshot in the single exit, with no FFI override) - A length of 0 encoded in 16 or 64 bits is accepted, like every other non-minimal length (undici and npm `ws` accept them too). A length of 2^53 or more has its own error. (no PR) Constructor and arguments: - Options are read through the prototype chain, stopping at `Object.prototype`. Before, inherited keys and getters were ignored, while `Object.prototype.perMessageDeflate = false` turned compression off everywhere. (#41674) - The documented `protocols: "chat"` threw "Value is not a sequence", and `protocol: "chat"` was dead code. (#41705) A second argument such as `null` or `5` is converted per WebIDL (was `TypeError: Type error`). `['a', 'A']` is a duplicate. (no PR) - One invalid `proxy.headers` entry dropped all of them, including `Proxy-Authorization`. It now throws. (#37638) - `ws://:token@host` sent no credentials, and `user:p%E9ss` sent the wrong password. (#44964) An explicit `Proxy-Authorization` header beats the proxy URL's credentials, matching `fetch` and the target (non-proxy) path. #44964 pinned the opposite. (no PR) - The URL's credentials are kept out of `ErrorEvent.message` and the `SyntaxError`s. (#41698, using `URL::removeCredentials()`; its `fetch` half landed in #42692) - `ping(undefined)` sent "undefined". (#39071) `ping(null)` sends no payload either, (no PR) Opening handshake: - A proxy's 407 was reported as "Proxy connection failed" whenever it arrived in one read, and `HTTP/1.1 200` without a reason phrase was rejected. (#43445) Any 2xx opens the tunnel, as in `fetch`. (#43511) - A 101 with more than 128 header fields failed with "Invalid response". `server.upgrade(req, { headers })` with 125 headers triggers it. (#43243, bounded by the byte limit instead of a new constant) The byte limit gave different results for different TCP segmentation. (#41573, WebSocket half) - `100 Continue` / `103 Early Hints` before the 101, or before the proxy's 200, are skipped. (no PR) - Bytes read while a handshake listener spins the event loop were parsed as a new HTTP head. (#43763, the buffer simplification only) - Header values are sent as latin-1. (#41482) `close()` / `terminate()` while CONNECTING close TCP with a FIN. (no PR) - Found by fuzzing (no PR): the two floods in item 8, and a missing exception check where a binary message is queued because nothing listens yet. - A response of fewer than 9 bytes that can't be HTTP (`foo\r\n`) left the client waiting for the 120 s handshake timeout. It now fails immediately with "Invalid response". A RST instead of a response reports "Connection ended: read ECONNRESET". (no PR) #### `Bun.serve` WebSocket server Crashes and memory safety: - **`server.upgrade(req)` returned `true` after a streamed `Response` had started.** It wrote the handshake headers into the chunked body and then segfaulted the release build (heap-use-after-free at the next `ws.send()` under ASAN). A request can no longer be upgraded once a `Response` has been accepted for it. (no PR) - `ws.subscribe(new String(...))` with a `toPrimitive` that closes the socket caused a heap-use-after-free at the next `publish()`, and `send` / `ping` reported bytes sent on a dead socket. All arguments are now converted first, followed by one state check. Nine methods became four bodies, and `server.publish()` shares their payload helpers. (#39385) - Upgrading a socket that had already been ended (a `ws` `'headers'` listener that calls `req.socket.end()`) was a SEGV on debug and a hang on release. `HttpResponse::upgrade()` now rejects it up front, and `us_socket_adopt` returns NULL instead of the same pointer. The check runs again after the 101 is written, because a head longer than the cork buffer is a real TLS write, which can shut down the socket. `upgrade()` then returns `false`. (#37447, only this part; #44618 fixed its two other paths) - `ws.send(sharedMemory, true)` while another thread writes to that memory overran libdeflate's output buffer. That code path is deleted, and #42318's two race tests pass under ASAN. (#42318 stays open for `Bun.gzipSync` and friends) - `server.reload()` leaked a uWS context per route (12 KiB per reload with 12 routes). There's now one context per owner. A reload refreshes settings and never replaces a live context's closures. (#41680) Lost data, hangs: - A new TEXT / BINARY frame inside a fragmented message was appended to it, and both were delivered as one message. Fixes #33010. (#33011) - `ws.close()` while over `backpressureLimit` lost accepted frames and the Close frame (the peer got 62 of 79, then a bare FIN). `ws.close()` inside `ws.cork()`, `drain`, or `open` after an async upgrade sent its FIN 16 s late. `end()` is now the only writer of a Close frame and owns the uncork and the FIN. (#39843, plus TLS variants of its tests) - `terminate()`, a throwing `open`, `stop(true)` and process exit dropped data that `send()` / `publish()` had accepted in the same tick. (#43711, a third of it; no `flush` flag) A throwing `open` now always lets the 101 be sent first. - The reply to a valid frame was lost when a later frame in the same read failed the connection (Autobahn 3.2, 4.1.4, 5.15). (falls out of #35874) - `idleTimeout: 65536`, `maxPayloadLength: 2 ** 32 + 16` and `backpressureLimit: 2 ** 32 + 1` wrapped to 0, 16 and 1. `idleTimeout` above 960 now always throws, and the other two are clamped. Fixes #13918. (#36998; docs from #40097) - `idleTimeout: 0` meant about 256 s (`0 - 4` in an unsigned short). `static_assert`s now guard the arithmetic. Part of #26554. (#34222) Protocol and API: - When the server fails a connection, it sends a Close frame with 1002 / 1007 / 1009 and the reason. That includes an invalid Close payload, which used to be echoed as an empty Close. Fixes #22723. (#35874, but the handler keeps 1006, which is what npm `ws` and browsers report) - `stop(true)` sends 1001. Part of #25722. (#34961, the `stop(true)` half, in `TemplatedApp::close()`) - permessage-deflate: - The negotiator is new and does a plain split and compare. The old tokenizer compared the *sum of the characters*, so `deflate-permessage` matched. `server_no_context_takeover` or `server_max_window_bits` is honored and echoed, invalid offers are declined, and fallback offers are tried. (#41629) - `compress: false` actually turns compression off, and `decompress: "16KB"` no longer sets the *compressor*. `{ compress: on, decompress: off }` keeps working. (#41637, without its throw) - Inbound BFINAL=1 blocks are accepted. (#33592) - Corrupt data closes with 1007. A message that inflates past the limit closes with 1009. - Each dedicated compressor and each dedicated decompressor uses 4 KB less. - `perMessageDeflate: true` sent messages that end in a final DEFLATE block, which makes Safari close with 1002 (WebKit bug 326651). All outbound messages now end in a sync flush. Fixes #25673. I checked this on the wire; I couldn't run Safari. (no PR) - A long `ws.close()` reason is truncated to 123 bytes on a character boundary. It used to be cut mid-character, so the client saw 1007. (#41665) - `upgrade({ headers })` duplicated `Sec-WebSocket-Accept`, `Upgrade` and `Connection`, and removed a field from the caller's `Headers`. (#41875) `headers: {}` threw, and a subprotocol couldn't be declined. Fixes #18243. (no PR) The result depended on an unrelated `req.headers` read or `await`. (#41962) Another server's `Request` cross-wired handlers and topics. (#41811, `upgrade()` only) - The 101 for an upgrade made after an `await` was sent in 25 writes (33 TLS records). It's now one write. (no PR) - An Upgrade / CONNECT request without `Host` gets a 400. It used to reach `fetch` with a relative URL. (#41670) - `upgrade(); throw`, and a rejection from a handler that upgraded after an `await`, were silently dropped. (#45000, but reported through `error()` / the `fetch` reporter instead of ending the process) `async: upgrade(); throw` is still an `unhandledRejection`. - `websocket.error(error, ws)`, typed. Fixes #11634. (no PR in this set; #41728 touches the types) - New: `ws.pause()`, `ws.resume()`, `ws.isPaused`. The idle timer is suspended while paused. Fixes #32483. (instead of #36749) - `drain` only fires after a `send()` that returned `-1`. A TLS socket used to get one right after the upgrade with nothing buffered, and each `pause()` / `resume()` would have caused one. (no PR) - `ws.cork(cb)` runs `cb` on a closed socket. `server.publish(t, d, undefined)` compresses like `publish(t, d)`. (#39253) `websocket: {}`, the first example in the docs, no longer throws "expects a message handler". (no PR) #### `ws` `src/js/thirdparty/ws.js` (two classes that forwarded lazily to native objects) is replaced by `ws.ts`: one `class WebSocket extends EventEmitter` ported from ws 8.22.0 (`websocket.js`, `websocket-server.js`, `event-target.js`, `stream.js`, `extension.js`, `subprotocol.js`, `validation.js`, and the negotiation half of `permessage-deflate.js`). Framing, masking, UTF-8 validation and deflate stay native, so there is no JS `Sender` / `Receiver`. All nine JS-only PRs together moved the old shim from 18 to 24 of my 212 client cases. The state machine had to live in one place. There are three transports: 1. **Client**: the native client connects. In this mode it calls one shared handler table (`this` = the `ws` object) instead of dispatching DOM events, so there are no listener objects per socket and no `MessageEvent` per frame. 2. **Server**: upstream's code builds the 101 in JS, native code writes those bytes, and uWS adopts the node:http connection into a context that has this `WebSocketServer`'s options. `_socket` is the real node:http socket, and its `'close'` is what emits the `ws` `'close'`. There are no queues and no ticks in JS. 3. **Any JS stream** (the stream transport), both roles: the native client engine reads from and writes to a JS stream. It's the slower path (numbers under Performance), and only these cases use it: - Server: any `Duplex`, `server.emit("connection", socket)`, http2 `allowHTTP1`, fastify's `injectWS`, a manual `setSocket()`, and a node:http connection on which frames were read before `handleUpgrade()` ran. - Client: a custom `agent` (SOCKS agents), `createConnection`, `lookup`, `finishRequest`. These go through the real `http.request()`, which is upstream's own path. `family`, `localAddress` and `localPort` take that path too. Crashes, lost or corrupted data: - **One request from any client ended the process** with an uncaught `TypeError` when the connection wasn't native: `http2.createSecureServer({ allowHTTP1: true })` (`vite --https`), `server.emit("connection", socket)` (socket.io's sticky sessions), or any `Duplex`. They now get a 101 over the stream transport. (#44460: took its native binding and `can_upgrade()`, replaced its 500; #28152's Proxy case is a test) - `await events.once(ws, "open")` on a port that refuses connections killed the process, and `once("message")` + `on("message")` delivered each message twice. (#37972; there are no per-socket closures at all now) - Server: a message after `ws.onmessage = null` was an uncaught `TypeError`, `addEventListener("message")` got a Buffer for text, and `onclose` got a number. Fixes #36060. (#44111) - Server: 64 x 1 MiB arrived as 83 frames, 62 of them out of order, and `close()` behind a backlog delivered 4 of 24. The second send queue in JS is deleted. Fixes #44971, #21376. (#44520, #39802) - `send(Buffer.from([0xff, 0x68]), { binary: false })` arrived as `ef bf bd 68`. `binary` didn't decide the frame type for ArrayBuffer and Blob. `{ fin: false }` sent three whole messages. (#44535: its native entries, plus `fin` and `compress`) - `send()` after `close()` acknowledged a dropped message with `cb(null)`. (#39840) Callbacks now mean "written": they wait if the peer isn't reading, and they fail when the socket dies. (no PR) - `finishRequest` with a late `req.end()` sent two handshakes, and `'open'` never fired. A request that was never ended connected anyway. (#44123, with no deferred native socket) - `maxPayload` was ignored in both directions: a limit of 100 let 101 bytes through, the default rejected 20 MiB, and socket.io's `maxHttpBufferSize` did nothing. It's now a native limit per `WebSocketServer`, checked at the frame header. Fixes #8261. (#36650) Client `maxPayload` works too. (no PR) - A custom `agent` was silently dropped, so a SOCKS proxy the user asked for was bypassed by a direct connection. The agent is now used. The tests run three kinds of SOCKS agent against a SOCKS5 server and check that a dead proxy isn't bypassed. Fixes #23208. (no PR) - Frames that arrive before a *deferred* `handleUpgrade()` (after an `await`, or a `verifyClient` that answers late) were lost: `["later"]` where Node gives `["early", "later"]`. Such a connection now uses the stream transport, which starts with `head` and whatever the socket has buffered. (#43176, without its replay on `nextTick`) - Server `close(999)`, `close(1004)` and `close(-1)` were sent on the wire. (#42011) Features and parity: - The closing handshake, in both roles (#39802; client: no PR): - After `close()` the socket is CLOSING, and messages that arrive before the peer's Close frame are still delivered. - `'close'` reports the peer's code (`4444 "theirs"`, was our own `4000 "mine"`), or 1006 if the peer only sends a FIN. - A listener added after `close()` or `terminate()` fires. - `terminate()` after `close()` is 1006. - `close()` leaves a paused socket paused. - The `closeTimeout` option works. - uWS got a mode for this: write the Close frame, keep reading, and report when the peer's Close, the FIN or `socket.destroy()` arrives. `Bun.serve` doesn't use it. - `createWebSocketStream()` is upstream's `stream.js`, with backpressure. Fixes #4568. (#35459) - `options.WebSocket` is honored, server sockets are `instanceof WebSocket`, and patches to `WebSocket.prototype` apply to them. Fixes #13317. (no PR) - `ws._socket` is the node:http socket on servers. On clients it's a small object with `remoteAddress` / `remotePort` / `remoteFamily`, `ref()`, `unref()` (engine.io-client's `autoUnref`) and `destroy()`. (no PR) - Server `pause()` / `resume()` / `isPaused`. Fixes #44453. (#44554; the tests fail against a `pause()` that only sets a flag) - Options that were accepted but ignored now work. Client: `handshakeTimeout`, `origin`, `auth`, `followRedirects` / `maxRedirects` / `'redirect'`, `protocolVersion`, `autoPong`, `skipUTF8Validation`. Server: `autoPong`, `skipUTF8Validation`, `perMessageDeflate`. `handshakeTimeout` and `closeTimeout` are no longer capped by the native 120 s / 30 s timers, because no native timer runs for a `ws` client. `protocolVersion: 8` is actually sent, with `Sec-WebSocket-Origin`. (no PR) - Headers that `'headers'` listeners push are included in the 101 (engine.io's cookies and `headers` event). `handleProtocols: () => false` no longer selects a protocol (graphql-ws). (no PR) - Errors match npm's: `Unexpected server response: 403` for every kind of listener (#36375) and with or without a listener (#45125, minus its two regressions); `connect ECONNREFUSED ...` with `code`; `WS_ERR_*` for protocol errors on both sides, with Close 1002 / 1007 / 1009 on the wire. (no PR) - `req.destroy()` / `req.abort()` work in `'unexpected-response'` and `finishRequest`. (#37973) `ping(null | false)` sends an empty frame. (#39093) Text is a Buffer for every `binaryType`, built natively. (#44255, #44553, #44112) `terminate.call(undefined)` throws. (#34873) - `send(null)`, `send([1, 2])` and `send({})` do what npm does (empty binary, bytes, `ERR_INVALID_ARG_TYPE`). `ping` / `pong` callbacks run later, with `null`. Accessors are enumerable, and the ready-state constants are read-only. `["Foo", "foo"]` are two subprotocols (the global `WebSocket` treats them as duplicates). (no PR) - Bun's extras carry over: `proxy`, `tls`, `HttpsProxyAgent`-style agents (connected natively), `ws+unix:`, `wss+unix:`. - `perMessageDeflate: { serverNoContextTakeover, clientMaxWindowBits, ... }` goes into the client's offer (it was always `permessage-deflate; client_max_window_bits`), and the server's response is validated against what was offered. (no PR) - A RST instead of a response is `read ECONNRESET` with `syscall: "read"`. A FIN is `socket hang up`. (no PR) - The body of a non-101 response in `'unexpected-response'`: `res` now gets the whole body, decoded (Content-Length, chunked with `fetch`'s decoder, or until EOF), even when it arrives after the head. The event itself isn't delayed. Before, a chunked body arrived raw and a body that came after the head was lost, so a gateway's JSON error didn't parse. The body has backpressure: a `res` that isn't read pauses the native read. A complete body sets `res.complete`. A truncated one ends as in Node: `'aborted'`, `'error'` `ECONNRESET`, no `'end'`. (no PR) - A 101 with no value in `Upgrade`, or without the `upgrade` option in `Connection`, is a final response with no body, as it is for node:http's parser: `'unexpected-response'`, then `'end'` on the response immediately. Without a listener it's `'error'` "Unexpected server response: 101". The global `WebSocket` fails such a 101 as before. (no PR) - Found by fuzzing (no PR): - A `handleUpgrade()` that runs a few ms late (an `await`, an async `verifyClient`) lost bytes, or the peer's FIN, that node:http had read but not yet handed to JS. Lost bytes failed a valid client in about 1% of such connections. A lost FIN left the socket open for good, which a remote peer could provoke (main too). Both now take the stream transport. - `req.socket.remoteAddress`, `servername`, `authorized` and `authorizationError` can still be read in `'close'`, whether the upgrade came from an `'upgrade'` or a `'request'` listener. - A send callback that throws no longer skips `'close'`, a stream's `'finish'`, or the callbacks behind it. On the stream transport each runs exactly once, although node:net on Bun drops some write callbacks and repeats others. - `handshakeTimeout` also covers the body of an `'unexpected-response'`. A refused upgrade behind a pipelined request answers on the right response. `createWebSocketStream()` finishes when the closing handshake is done. - `tls` / `proxy.tls`: inherited, non-enumerable and getter options are honored, also next to a `pfx`, and `Object.prototype` is ignored. #### node:http - `socket.bytesWritten` of an `'upgrade'` / `'connect'` socket was 0. It now counts raw writes (queued ones too) and the 101 that `ws` sent, and it keeps its value after close. `bytesRead` counts the tunnel's bytes. engine.io closes every upgraded socket on its `http.Server` whose `bytesWritten` is 0 after 1 s, which is the cause of "vite / SvelteKit dev + socket.io reloads every second". Fixes #23747. (#45030: its sum and its test lines, plus corked, backpressured and closed sockets) Not counted: WebSocket frames after a native upgrade, and HTTP heads in `bytesRead`. - A node:http server no longer registers a `Bun.serve`-style `websocket` route. The `NodeHTTPResponse` arm of `server.upgrade()`, `NodeHTTPResponse::upgrade()` and `UpgradeCTX` are deleted (375 lines). - Pinned by tests: `socket.destroy()` and `socket.setTimeout(0)` after an upgrade; `http.Server#close()` leaves `ws` connections open. #### undici - Added `require("undici").ping(ws, body?)`, and `undici:websocket:ping` / `:pong` on `node:diagnostics_channel`, with a `Buffer` payload for every `binaryType`. Without them, Slack Socket Mode / Bolt reconnected forever. Fixes #37110. (#37111, with two shared listeners instead of two closures per socket, undici's order of argument checks, and `"blob"` handled) - `require("undici").WebSocket` is now a subclass of the global one instead of the same object. Only its sockets publish to those channels. The `open` / `close` / `socket_error` channels stay silent. #### Types and docs - `error` / `onerror` are `ErrorEvent`. Fixes #36329. (#42673, #39069) Added `ping` / `pong` events, `binaryType: "blob"` and `Blob` payloads. (#39069) `headers` accepts `Headers` and pairs, and with lib.dom loaded, `Bun.WebSocket`'s `message` event has `.data` again. (no PR) The fixtures assert on `Bun.WebSocket`, so the list of expected lib.dom diagnostics didn't change. - `serve.d.ts`: `error?(error, ws)`, `pause` / `resume` / `isPaused`, `message?` is optional, `cork<R>` (its `T` shadowed the data type), option ranges and what 0 means, `close()` codes, compress defaults, and four examples that called the wrong method. - `websockets.mdx`: every example runs and type-checks as pasted (the first one threw). New "Closing connections" and "Errors" sections. One Origin check for cookie-authenticated upgrades, which allows a missing `Origin` so that non-browser clients work (#36155). Also compress defaults (#39253), backpressure (#41679, WebSocket half), `pause()` (#42976, the paragraph but not its JSDoc) and casing (#42443). The hand-copied Reference block had drifted on nine members and is replaced by links, which makes #40879 moot. - `ws.ts` is fully typed (`tsc` on `src/js`: 0 errors, also with `noImplicitAny`). Adding the types left the generated module byte-identical. #### Tests - #39370 took `websocket-server.test.ts` on a debug build from 40 s with 4 timeouts to 13 s and green (the file has grown since). - The writev fault test never reached `us_socket_write2`. (#38174) - `websocket-pause.test.ts` streams 32 MiB instead of 256 MiB and fails immediately when a send is dropped. (#41109, the constant and about 15 lines) - `ws-syscall-fault.test.ts` went from 7.6 s to 3.2 s on debug. (#37115, without the asserts that froze four differences from npm) - `setSocketOptions()` of `bun:internal-for-testing` (`SO_SNDBUF` / `SO_RCVBUF`) now takes any socket Bun owns: a `ws` or global `WebSocket`, a `ServerWebSocket`, TLS sockets, node:net and node:http sockets. It also works on Windows, where it did nothing. With a 64 KiB send buffer a sender hits backpressure after about 200 KB instead of 4.2 MB, so the backpressure tests send 1 MiB instead of 12 to 64 MiB. - No test sits through a real close timeout (uSockets sweeps every 4 s, so "1 s" is 4 to 8 s). Those were removed, and the numbers are under "Fuzzing before merge". - Autobahn fan-out (#35421): not run here, it needs docker. - `hostname: "127.0.0.1"` where a test connects to 127.0.0.1. (#41331, plus `websocket-proxy.test.ts`) I haven't swept the other files that have the same pattern. - Two stale `todo`s are now real tests, and so are `ws`'s five early-frame `todo`s (#43176). The empty `perMessageDeflate` todo and an empty `skip` are removed. - New in `test/js/first_party/ws`: the `ws-*-compat-*.test.ts` files, `ws-stream-transport.test.ts`, a rewritten `ws-upgrade-events.test.ts` (18 files) and one raw-peer helper. Every block runs twice: on the built-in, and on `node_modules/ws` loaded by path. No sleeps. ### Performance **`bench/websocket-server`** (the chat room in this repo, 32 clients in 4 client processes as its README suggests, server on 4 reserved cores, 6 interleaved rounds, this PR at `6564a70`): Throughput against main: `Bun.serve` pub/sub -1.1% (main against a copy of itself: +1.4%), `ws` -4.6% (copy: -4.1%). That's inside the noise, so I also counted instructions per delivered message. `Bun.serve`: 758 on main, 775 here. `ws`: 12,477 on main, 12,628 here (95% of the time is in the kernel's TCP stack). **Receiving compressed messages in a client** (global `WebSocket`, server without context takeover, which is `Bun.serve`'s default; user-space instructions per message, this PR at `6605b96`): | JSON message | main | this PR | |---|---|---| | 512 B | 35,958 | 16,375 | | 2 KB | 57,948 | 26,022 | | 16 KB | 224,533 | 101,941 | | 64 KB | 718,398 | 333,248 | The client tried libdeflate first, which can't inflate an unfinished stream, so it decoded every message, failed at the end, and zlib decoded it again. It now appends a final empty block, as uWS does on the server, and only uses libdeflate without context takeover. **My own scripts:** Both binaries are CI's own release builds: this PR at `d51fcce`, and `9510e74`, the main commit it's based on. 8 physical cores were reserved: 4 for the side being measured and 4 for the other end, which is always main's binary. Runs are interleaved, and each number is the median of 7 rounds. "main again" is a byte-identical copy of main's binary, so the difference between the first two columns is the noise. `ws` client (echo server: main's `Bun.serve`): | shape | main | main again | this PR | |---|---|---|---| | ping-pong 64 B, round trips/s | 43,469 | 43,838 | 46,403 | | pipelined echo 64 B, msg/s | 261,627 | 263,397 | 299,713 | | echo 16 KB, msg/s | 98,230 | 94,591 | 97,603 | | compressed echo 2 KB, msg/s | 106,904 | 106,657 | 107,253 | | idle connection, KB | 9.2 | 9.1 | 10.4 | `ws` server (load generator: main's native `WebSocket`): | shape | main | main again | this PR | |---|---|---|---| | ping-pong 64 B, round trips/s | 43,011 | 43,784 | 45,172 | | pipelined echo 64 B, msg/s | 271,840 | 276,301 | 273,717 | | echo 16 KB, msg/s | 81,858 | 83,697 | 82,962 | | `send()` to 100 clients in a loop, 128 B text, deliveries/s | 345,531 | 352,509 | 381,826 | | idle connection, KB | 7.9 | 7.7 | 7.4 | The loop row is `for (const c of wss.clients) c.send(data, { binary: false })`, not pub/sub. It measures per-`send()` overhead. The old shim decoded the `Buffer` to a string on every such call; the new code passes the bytes and the opcode straight through. Compressed echo on the server can't be compared, because the old shim never negotiated permessage-deflate. The global `WebSocket` client and `Bun.serve` are level with main on the same three shapes (ping-pong, pipelined echo, echo 16 KB): every difference is under 1.6%, and main differs from its own copy by up to 2.4%. `Bun.serve`, `ws.send(x, true)` echo with the libdeflate compress path deleted (older numbers: local release builds, a busy machine): the shared compressor is 10% to 2.5x faster than main from 64 B to 16 KB. The dedicated one is 7% slower at 64 B and 1.3x to 5x faster from 512 B to 16 KB. Bytes on the wire for 64 B to 4 KB slices of `package.json`: the shared compressor is within 4 bytes of main, and the dedicated one is 11 to 26% smaller from 512 B up. Supporting the server role in the client engine costs a natively connected client one predictable branch per received frame and two per sent frame. The global `WebSocket` table above measures that. Every `JSWebSocket` cell grew by 16 bytes (owner and handler table). Each upgrade client is 4 KB smaller (a header array was removed). Binary size: +64 to +128 KB per target (CI's table). ### How did you verify your code works? **Oracles.** Node 26.3.0 (its global `WebSocket` is undici 8.3); npm `ws` 8.18.3 (the repo's test dependency), on Node and, loaded by path, on Bun; the source and tests of `ws` 8.22.0; RFC 6455, RFC 7692 and the WHATWG standard. Where Node and a spec disagree, I say so above. **Against Node + npm `ws`** (release build): | what | main | this PR | |---|---|---| | `ws`'s own test suite, 271 tests, in a sandbox without network | 94 | 234 | | 212 client cases: one process each, raw `node:net` peer, output compared with Node's byte for byte | 18 | 179 | | 159 server cases, same method | 67 | 150 | | new permanent suite, built-in rows that fail (measured at 1,233 rows; it has grown since) | 800 of the 1,082 that finish | 0 | - The remaining failures in `ws`'s own suite reach into the JS `Sender` / `Receiver` / `net.Socket` of a natively connected client (`ws._receiver`, `ws._socket.on`, `generateMask`, file-backed Blobs), which don't exist here. - The remaining client cases differ in the wording of engine errors (V8 / JSC), ws 8.22 versus the 8.18 that produced the recorded output, the order of request headers, and the kept differences listed above. **Each new or changed test was first run on main's release build**, and I read the failure. It has to fail for the stated reason, not by timing out. Some new tests pass on main: they pin existing behavior to guard the rewrites. **Debug + ASAN build**, with `BUN_JSC_validateExceptionChecks=1` as on CI's ASAN lane: every file under `test/js/web/websocket`, `test/js/bun/websocket` and `test/js/first_party/{ws,undici}`, plus `node-http`, `node-https`, `node-http-connect`, `node-http-with-ws`, `node-tls-connect`, `bun-server`, `request-smuggling`, fastify-websocket and `bake/deinitialization`. 80 files and 6,001 tests, all pass. - Wire logs from a raw peer and the client on one clock: `send` x 32 + `close` delivers 32 of 32 (main: 10, and 2 at 64 KiB); 256 of 256 through the tunnel with the Close last; Pong before Close on `wss://`. **CI**: every platform built, and the new `ws` suite passed on macOS and Windows. **Fuzzing before merge.** Up to seven agents, one area each, ran seeded generators in a jail on CI's release builds of this PR, main, released Bun and Node, and on debug + ASAN. After each round I fixed what they found, another agent turned each repro into a test that fails on the old binary, and the hunt ran again on the new one. | | round 1 | round 2 | round 3 | round 4 | |---|---|---|---|---| | cases | over 1M | 400k | 300k | 200k | | crashes, sanitizer reports | 0 | 0 | 1 use-after-free | 0 | | regressions from main | 6 | 5 | 0 | 0 | | bugs in the fixes of the round before | | 6 | 5 | 2, low | - Proxy trust: over 350,000 combinations of options, certificates and routes against a model. Nothing opened that must be rejected, and no credential or client certificate reached the wrong peer, except a `pfx` next to inherited or hidden options (fixed). The same model flags main in 90 of 800 cases. - The use-after-free came from one of my fixes for round 1: it ran the `ws` drain handler after uWS's close handler, when GC may already have freed the native socket. It needed a script that clears private symbols. That code is gone, and uWS again calls nothing after the close handler. - Close timeout, measured on CI's release build on ws, wss, a unix socket and through http, https and authenticated proxies: `send(100 MB); close()` at 2 MB/s delivered 82.5 MB and closed 1006 before the fix, 100 MB and a clean 1000 after it. A peer that stops reading at once, halfway or 1 KB before the end is dropped one timeout after its last read. One that reads everything but never answers is dropped one timeout after the flush. - Late `handleUpgrade()`: 9 of 1,250 connections lost bytes before the fix, 0 of 1,500 after it, then 0 of about 50,000 generated cases of valid traffic (the generator fails 119 of 8,000 on the build before). **`Bun.serve` against main**, for "keeps accepting what released Bun accepts": the same 8,700 server calls, 1,492 client calls, 26 handshakes and 19 close codes on both. What only this PR refuses: an HTTP/1.1 upgrade without `Host`, a repeated `Sec-WebSocket-Key`, `idleTimeout` of 65,536 or more, and `upgrade()` with another server's request. Five more were found this way and taken out. At scale (50,000 connections, a 20-minute soak with 438,000 connections, fan-out, dead consumers, reconnect storms, `stop()` / `reload()` with 20,000 open) only item 13's memory and item 10's close code differ from main. **Two security scans** of the whole diff found nothing above low severity except two denial-of-service bugs in `ws`. All four findings were reproduced and fixed with tests: - Unbounded automatic Pongs (described above). The cap is on all three transports, because a peer can choose the transport by sending a frame before a deferred upgrade. - A redirect `Location` (`/#`, `ws+unix::/x`) threw out of the native handshake callback and ended the process. - Bun's `tls: { ca, checkServerIdentity, ... }` option was dropped whenever the client connects through `http.request()` (`finishRequest`, `lookup`, `family`, ...), so a certificate pin was lost (1.4.3 enforces it). - `tls`, `proxy` and `agent` could be set through a polluted `Object.prototype` (1.4.3 has one such case too). **A review of the whole branch** found 15 issues, fixed with tests. The worst: a use-after-free of the server when `handleUpgrade()` gets a request from a server that was already freed, a stream wrapping the socket that `handleUpgrade()` bypassed, and the ignored client options `signal` and `secureContext`. **Lints**: `cargo clippy --workspace`, `cargo check --workspace --all-targets`, `rust:check-all` (every target), `bun lint`, the three `tsc` projects, clang-format, rustfmt, prettier, `test/internal/source-lints`. **Types**: `bun-types.test.ts` passes 22 of 22. With main's `.d.ts` and the new fixtures, 10 of 22 fail. **Not run**: - #44633's script on Windows. It's worth trying, since the 101 and the Close now leave in one write. Some backpressure tests are skipped on Windows, as they were in the original PRs. - Autobahn (needs docker), Safari, WebView with a real Chrome. - "No ping and no idle close on a `ws` server" has no automated test, because it needs 135 s. I checked it by hand, with the three options injected into main. ### The pull requests Thanks to the outside contributors whose reports and patches are in here: @C0casio45 (#28152), @hughescr (#34222), @steipete (#44553, #44554, #45030), @davidhevn (#42673), @deepshekhardas (#40879, #42443), @ousamabenyounes (#36749), @alex-mextner (#31205); and to @1cedsoda, whose #44061 / #44165 stay open. "ext" = from an outside contributor. taken = as it was, or nearly. reworked = same bug, different fix. superseded = falls out of a larger change here. | PR | author | verdict | why | |---|---|---|---| | #20533 | Jarred-Sumner | not taken | clang already emits `bswap` / `rol`, so the assembly is identical | | #24914 | Jarred-Sumner | obsolete | fixed by #25475; in BoringSSL the line marks every TLS socket low priority | | #28152 | C0casio45 (ext) | obsolete | next-ws awaits before `handleUpgrade()`; #39642 fixed that. Proxy case kept as a test | | #31205 | alex-mextner (ext) | not taken | its cases compile on main; I widened `headers`, which is probably what the author hit | | #31761 | robobun | reworked | one snapshot in the single exit; counts payload bytes only | | #31982 | robobun | taken | | | #33011 | robobun | taken | plus BINARY inside TEXT | | #33066 | robobun | reworked | one `dispatchEvent` override, not 20 renamed call sites | | #33592 | robobun | taken | | | #34222 | hughescr (ext) | reworked | the one-line fix + `static_assert`s; no test binding, no 20 s tests that pass without the fix | | #34873 | robobun | superseded | by the port | | #34961 | robobun | reworked | `stop(true)` half only; `stop()` stays graceful as documented | | #35029 | robobun | reworked | `span()` kept; detached = empty, no TypeError | | #35031 | robobun | not taken | breaks `close(1001)` / `close(1011)` | | #35421 | robobun | taken | | | #35459 | robobun | superseded | upstream's `stream.js`, with the backpressure the PR dropped | | #35730 | robobun | not taken | 0.8 s on a test that CI skips | | #35874 | robobun | reworked | handler keeps 1006; 1007 vs 1009 for inflate errors | | #36112 | robobun | taken | plus the missing timeout | | #36155 | robobun | reworked | one check and a short warning; a missing `Origin` is allowed | | #36375 | robobun | superseded | upstream's `abortHandshake`, every kind of listener | | #36561 | robobun | not taken | same as #35730 | | #36650 | robobun | reworked | native limit per `WebSocketServer`; `'close'` is 1006, not 1009 | | #36749 | ousamabenyounes (ext) | not taken | frames from one read still overlap; deadlocks request / response over one socket. `ws.pause()` instead | | #36808 | robobun | obsolete | replaced by #37275 | | #36998 | robobun | taken | | | #37111 | robobun | reworked | shared listeners, `"blob"`, undici's check order | | #37115 | robobun | reworked | `describe.concurrent` only | | #37439 | robobun | stays open | WebSocket half landed in #40624; the rest is `fetch` | | #37447 | robobun | reworked | the early rejection only; #44618 fixed two of its three paths | | #37463 | robobun | obsolete | landed in #43557; test kept | | #37559 | robobun | not taken | refactor of code that #40018 rewrote | | #37638 | robobun | taken | | | #37972 | cirospaciari | superseded | one handler table, so no listeners to install twice | | #37973 | cirospaciari | superseded | one request class; npm's rows | | #38174 | robobun | taken | | | #38177 | robobun | obsolete | fixed by #40566 | | #38632 | robobun | taken | | | #39069 | robobun | reworked | `.d.ts` taken; fixture on `Bun.WebSocket` | | #39071 | robobun | taken | plus `null` | | #39082 | robobun | reworked | the server's error class, one FFI call | | #39093 | robobun | superseded | upstream's line | | #39253 | robobun | taken | plus `publish(t, d, undefined)` | | #39255 | robobun | not taken | a `send()` cancels the ping deadline, as released | | #39370 | robobun | taken | | | #39385 | Jarred-Sumner | taken | ported by hand; `sendBinary`, `close`, ping / pong too | | #39608 | robobun | stays open | not WebSocket; its two `ErrorEvent` lines are here | | #39802 | robobun | reworked | no JS queue, no tick; native "wait for the peer's Close" | | #39840 | robobun | superseded | upstream's lines | | #39843 | robobun | taken | plus TLS tests | | #40097 | robobun | superseded | by #36998; docs lines kept | | #40879 | deepshekhardas (ext) | obsolete | the block it fixes is deleted | | #41109 | robobun | reworked | the constant + 15 lines | | #41331 | robobun | taken | | | #41482 | robobun | reworked | Rust only, smaller | | #41573 | robobun | reworked | WebSocket half; `fetch` half dropped | | #41629 | robobun | reworked | new negotiator, fallback offers, no x-webkit | | #41637 | robobun | reworked | no throw for a config that works today | | #41665 | robobun | taken | | | #41670 | robobun | taken | | | #41674 | robobun | taken | | | #41679 | robobun | reworked | three sentences; `routing.mdx` half not taken | | #41680 | robobun | reworked | never replaces a live context's closures | | #41698 | robobun | reworked | `removeCredentials()`; `fetch` half landed in #42692 | | #41705 | robobun | taken | inside #41674's code | | #41712 | robobun | stays open | product decision | | #41728 | robobun | stays open | not only WebSocket; overlaps in `websockets.mdx` and `error` | | #41811 | robobun | reworked | `upgrade(Request)` only | | #41875 | robobun | taken | plus `headers: {}` and declining a protocol | | #41962 | robobun | taken | | | #42011 | robobun | superseded | upstream's checks, both roles | | #42216 | robobun | reworked | 5 lines, no budgets | | #42318 | robobun | stays open | the libdeflate patch is a vendoring decision; the WebSocket path is deleted, its two tests are kept | | #42443 | deepshekhardas (ext) | taken | | | #42673 | davidhevn (ext) | taken | its two lines; a different fixture, because the lib.dom run fails with the PR's own | | #42974 | robobun | reworked | `resume()` on close; the rest follows from `readyState` | | #42976 | robobun | taken | trimmed | | #42978 | robobun | taken | derived from `readyState` | | #43018 | robobun | reworked | with #43696: one field instead of four | | #43176 | robobun | reworked | these connections use the stream transport; as written, the PR would deliver `head` twice | | #43243 | robobun | reworked | bounded by the byte limit | | #43445 | robobun | taken | | | #43511 | robobun | taken | | | #43614 | robobun | stays open | goes with #43441 | | #43696 | robobun | reworked | the deletion only; no nested-event-loop cases | | #43711 | robobun | reworked | `terminate()` and exit flush; no flag | | #43763 | robobun | reworked | "always buffer"; no `handshake_dispatched` | | #44061 | 1cedsoda (ext) | stays open | RFC 8441 is a separate feature; needs a rebase | | #44111 | robobun | superseded | upstream's `event-target.js`, both roles | | #44112 | robobun | reworked | second native handler set, no per-event flag | | #44122 | robobun | not taken | used its options struct and test table; no `validate()` / `dial()` split | | #44123 | robobun | reworked | real `http.request()`; no deferred native socket | | #44165 | 1cedsoda (ext) | stays open | built on #44061 | | #44255 | robobun | superseded | native Buffer for text | | #44460 | robobun | reworked | binding + `can_upgrade()`; 101 instead of 500 | | #44520 | robobun | reworked | no backpressure limit, JS queue deleted | | #44535 | robobun | reworked | native entries + `fin`, `compress`; no lint | | #44553 | steipete (ext) | superseded | same result, built natively; test kept | | #44554 | steipete (ext) | reworked | public `ServerWebSocket.pause()`; tests that fail against a no-op `pause()`; no 120 s kill | | #44821 | robobun | taken | plus `realign` | | #44822 | robobun | reworked | three small changes instead of five mechanisms | | #44964 | robobun | taken | explicit `Proxy-Authorization` wins | | #45000 | robobun | reworked | reports the error and keeps serving | | #45030 | steipete (ext) | reworked | its sum and tests; plus cork, backpressure, close, `bytesRead`, the 101 | | #45122 | robobun | taken | extended to failures after open, and 1006 | | #45125 | robobun | superseded | falls out of `emit("error")`; two regressions avoided | | #45196 | robobun | reworked | moves the `close` event; no second parser | Issues that can also be closed: - #22870: the client option works; the reporter set it on the server. - #18869: the code in its trace was rewritten by #39642 / #39435, and it has no s…

robobun assigned Jarred-Sumner Sep 27, 2026

robobun requested a review from alii as a code owner September 27, 2026 10:05

github-actions Bot added the claude label Sep 27, 2026

This was referenced Sep 27, 2026

ws: implement the EventTarget interface of npm ws on server sockets #44111

Closed

ws: convert text frames to strings in server socket EventTarget API #36061

Closed

robobun mentioned this pull request Sep 27, 2026

ws: differences from npm ws that remain on the built-in client and server sockets #44108

Closed

claude Bot reviewed Sep 27, 2026

View reviewed changes

Comment thread src/js/node/_http_server.ts Resolved

Comment thread test/js/first_party/ws/ws.test.ts Resolved

robobun force-pushed the robobun/f8ac4f18/ws-server-native-payloads branch from 4c8fca6 to 6945fdf Compare September 27, 2026 11:18

claude Bot reviewed Sep 27, 2026

View reviewed changes

robobun force-pushed the robobun/f8ac4f18/ws-server-native-payloads branch from 6945fdf to 4f53d0f Compare September 28, 2026 22:48

claude Bot reviewed Sep 28, 2026

View reviewed changes

github-actions Bot reviewed Sep 29, 2026

View reviewed changes

Comment thread src/runtime/server/ServerWebSocket.rs Resolved

claude Bot reviewed Sep 29, 2026

View reviewed changes

robobun mentioned this pull request Sep 29, 2026

Bun.serve: stop leaking a uWS WebSocketContext per route on every reload() #41680

Closed

claude Bot reviewed Sep 29, 2026

View reviewed changes

robobun added 7 commits September 29, 2026 16:46

ws: take the events of a bridge over Bun.serve(), and fail the --hot …

02862ee

…test fast The server socket keeps taking what the handlers of a Bun.serve() get, a string for a text frame and no frame type, from a bridge that is not node:http's.

ws: keep each comment of the native payload change to one line

03823a5

ws: choose the message, ping and pong callbacks when the route is reg…

b6f3d62

…istered Handlers that came with onNodeHTTPRequest get uWS callbacks of their own. The callbacks of Bun.serve() handlers read no flag for a message.

ws: test a socket that stays open over a --hot reload

299c57a

ws: keep the comment of the landing frame to one line

008e5ce

robobun force-pushed the robobun/f8ac4f18/ws-server-native-payloads branch from 0af6b2e to 008e5ce Compare September 29, 2026 16:47

robobun mentioned this pull request Oct 1, 2026

ws: give on('message') a Buffer for a text frame in every binaryType #44255

Closed

robobun mentioned this pull request Oct 3, 2026

[JSC] The slow path of a run-time-length array allocation takes the butterfly from the size class of its inline path oven-sh/WebKit#767

Open

robobun mentioned this pull request Oct 3, 2026

ws: take the frame type of send() from options.binary and frame the payload natively #44535

Closed

Jarred-Sumner mentioned this pull request Oct 14, 2026

WebSocket: real closing handshake, one failure path, ws rewritten on native transports (consolidates the open WebSocket PRs) #45223

Merged

Jarred-Sumner closed this Oct 14, 2026

Conversation

robobun commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Fix

Background

Downsides

Uh oh!

robobun commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

robobun commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Uh oh!

robobun commented Sep 28, 2026

Uh oh!

Jarred-Sumner commented Sep 28, 2026

Uh oh!

robobun commented Sep 28, 2026

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Uh oh!

robobun commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Uh oh!

robobun commented Oct 3, 2026

Uh oh!

Jarred-Sumner commented Oct 14, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

robobun commented Sep 27, 2026 •

edited

Loading

robobun commented Sep 27, 2026 •

edited

Loading

robobun commented Sep 27, 2026 •

edited

Loading

robobun commented Sep 29, 2026 •

edited

Loading