{"version":"2.1.94","anchor":"websocket-decompression-bomb-protection","canonical_anchor":"websocket-decompression-bomb-protection","heading":"WebSocket Decompression Bomb Protection","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.94\/e\/websocket-decompression-bomb-protection","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.94","markdown":"### WebSocket Decompression Bomb Protection\n\nWebSocket message handling now tracks cumulative decompressed size and enforces a `maxDecompressedMessageSize` limit (default 4 MB). Messages exceeding this limit are rejected with `\"Max decompressed message size exceeded\"`.\n\n**Evidence**\n\nDecompression protection (search for `\"maxDecompressedMessageSize\"`)"}