WebSocket message handling now tracks cumulative decompressed size and enforces a maxDecompressedMessageSize limit (default 4 MB). Messages exceeding this limit are rejected with "Max decompressed message size exceeded".
Evidence
Decompression protection (search for "maxDecompressedMessageSize")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.