Client-side maxFragments default (16384) is too aggressive — breaks legitimate high-fragment traffic from trusted servers #2335

Is there an existing issue for this?

• I've searched for any related issues and avoided creating a duplicate issue.

Description

Problem

The GHSA-96hv-2xvq-fx4p fix lowered the default maxFragments from 131072 → 16384 and maxBufferedChunks from 1048576 → 65536 in both initAsClient and WebSocketServer. While this is effective defense-in-depth for servers handling untrusted peers, it also applies to clients connecting to trusted servers — where the threat model is fundamentally different.

In our scenario, we use the ws library as a client connecting to a database server. The server legitimately sends query result sets as WebSocket messages split across many continuation frames (tens of thousands of fragments for large results). With the new default of 16384, the connection is terminated mid-transfer with:

RangeError: Too many message fragments
code: 'WS_ERR_TOO_MANY_BUFFERED_PARTS'
status-code: 1008
This is not an attack — it is a normal, large data transfer from a server we explicitly chose to trust.

The same default is applied to both roles, which means every client workload that happens to produce >16384 fragments now breaks out of the box.

Suggestion

Differentiate client vs. server defaults.
Keep the tighter defaults for WebSocketServer, but relax (or disable) the fragment/chunk count limits for initAsClient.

Workaround (for anyone hitting this now)

Explicitly set maxFragments: 0 when creating the client WebSocket:

const ws = new WebSocket(url, {
    maxFragments: 0
});

ws version

8.21.1

Node.js Version

v27.0.0-pre

System

Expected result

The client, using the new WebSocket(), successfully retrieves a large amount of data from the server.

Actual result

cause: RangeError: Too many message fragments
        at Receiver.getData (/root/api_performance/workdir/codes/workspace/js/dolphindb/node_modules/.pnpm/ws@8.21.1/node_modules/ws/lib/receiver.js:505:26)
        at Receiver.startLoop (/root/api_performance/workdir/codes/workspace/js/dolphindb/node_modules/.pnpm/ws@8.21.1/node_modules/ws/lib/receiver.js:190:16)
        at Receiver._write (/root/api_performance/workdir/codes/workspace/js/dolphindb/node_modules/.pnpm/ws@8.21.1/node_modules/ws/lib/receiver.js:117:10)
        at writeOrBuffer (node:internal/streams/writable:570:12)
        at _write (node:internal/streams/writable:499:10)
        at Writable.write (node:internal/streams/writable:508:10)
        at Socket.socketOnData (/root/api_performance/workdir/codes/workspace/js/dolphindb/node_modules/.pnpm/ws@8.21.1/node_modules/ws/lib/websocket.js:1374:35)
        at Socket.emit (node:events:508:28)
        at addChunk (node:internal/streams/readable:559:12)
        at readableAddChunkPushByteMode (node:internal/streams/readable:510:3) {
      code: 'WS_ERR_TOO_MANY_BUFFERED_PARTS',
      Symbol(status-code): 1008
    }

Attachments

No response