---
package: "@webjsdev/server"
version: 0.8.8
date: 2026-06-02T09:15:13.538Z
commit_count: 1
---
## Fixes

- **harden auth and websocket against malformed input (DoS)** ([#215](https://github.com/webjsdev/webjs/pull/215)) [`fd2913a3`](https://github.com/webjsdev/webjs/commit/fd2913a3)
  * fix: a malformed auth cookie reads as no session instead of crashing
  
  unsign() calls atob via unb64url, which throws a DOMException on non-base64
  input, but unlike decodeJwt it had no try/catch. So a malformed or
