# Risk map — mswjs/msw

> Canonical page: https://codevetter.com/unpack/msw/risk-map

# Risk map — mswjs/msw

Scanned commit 6d6aef1640ace2ce2bd90252c71bdbc53262efd3 (2026-09-30). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These are source observations and explicitly marked hypotheses, not confirmed vulnerabilities. Network passthrough, persistent cookies, worker messaging, and serialized handler exceptions are the principal security-sensitive boundaries inspected. Shared lifecycle and streaming code has a broad behavioral impact, with regression tests documenting past failure modes. Documentation and automation also contain drift that should be verified before relying on their instructions.
- Default warn handling permits real HTTP traffic after warning; explicit bypass and passthrough also reach the network, while unmatched CONNECT bypasses regardless of the configured unhandled strategy. — [src/browser/setup-worker.ts#L72-L75](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/src/browser/setup-worker.ts#L72-L75) [src/core/experimental/on-unhandled-frame.ts#L35-L71](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/src/core/experimental/on-unhandled-frame.ts#L35-L71) [src/core/experimental/frames/http-frame.ts#L193-L227](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/src/core/experimental/frames/http-frame.ts#L193-L227) [src/mockServiceWorker.js#L302-L319](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/src/mockServiceWorker.js#L302-L319)
- Browser mock cookies persist as JSON in origin localStorage and are also assigned to document.cookie; only persistence writes are caught for quota errors, while the initial localStorage.getItem call is outside that catch. — [src/core/utils/cookie-store.ts#L45-L53](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/src/core/utils/cookie-store.ts#L45-L53) [src/core/utils/cookie-store.ts#L89-L95](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/src/core/utils/cookie-store.ts#L89-L95) [src/core/handlers/request-handler.ts#L673-L680](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/src/core/handlers/request-handler.ts#L673-L680)
- ServiceWorkerHttpNetworkFrame.errorWith converts handler exceptions into HTTP 500 JSON containing name, message, and stack; Node's interceptor frame instead throws ordinary errors, creating an environment-specific error surface. — [src/browser/sources/service-worker-source.ts#L509-L535](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/src/browser/sources/service-worker-source.ts#L509-L535) [src/core/experimental/sources/interceptor-source.ts#L159-L168](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/src/core/experimental/sources/interceptor-source.ts#L159-L168)
- WorkerChannel filters messages with a non-null source unequal to the selected worker, then accepts object payloads containing type; WebSocket managers process worker-stop window messages by type and remote BroadcastChannel commands by client id. — [src/browser/utils/worker-channel.ts#L161-L172](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/src/browser/utils/worker-channel.ts#L161-L172) [src/ws/websocket-client-manager.ts#L53-L58](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/src/ws/websocket-client-manager.ts#L53-L58) [src/ws/websocket-client-manager.ts#L134-L157](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/src/ws/websocket-client-manager.ts#L134-L157)
- The worker checksum is a normalized-source MD5 compatibility marker: mismatch produces a warning and resolves the integrity promise instead of blocking startup. It should not be interpreted as an authentication or tamper-enforcement mechanism. — [config/plugins/rolldown/copy-worker-plugin.ts#L16-L47](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/config/plugins/rolldown/copy-worker-plugin.ts#L16-L47) [src/browser/sources/service-worker-source.ts#L405-L433](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/src/browser/sources/service-worker-source.ts#L405-L433)
- WebSocketHandler emits connection events synchronously, with an explicit FIXME about propagating asynchronous listener exceptions; the frame's try/catch surrounds that synchronous emission. — [src/ws/websocket-handler.ts#L295-L302](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/src/ws/websocket-handler.ts#L295-L302) [src/core/experimental/frames/websocket-frame.ts#L175-L200](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/src/core/experimental/frames/websocket-frame.ts#L175-L200)
- CLI destinations accept absolute paths or resolve relative paths without repository containment, then create directories and overwrite the worker file; saving replaces the msw object with workerDirectory, so unrelated msw fields are not preserved by that assignment. — [cli/init.js#L100-L137](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/cli/init.js#L100-L137) [cli/init.js#L182-L199](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/cli/init.js#L182-L199)
- Hypothesis: TypeScript-nightly may fail to exercise the intended RC check because compare writes step outputs without declaring job outputs, while test reads needs.compare.outputs and copies a version-specific config using a questionable shell interpolation. This needs workflow validation; no failure was observed. (inferred) — [.github/workflows/typescript-nightly.yml#L13-L41](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/.github/workflows/typescript-nightly.yml#L13-L41) [.github/workflows/typescript-nightly.yml#L62-L72](https://github.com/mswjs/msw/blob/6d6aef1640ace2ce2bd90252c71bdbc53262efd3/.github/workflows/typescript-nightly.yml#L62-L72)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)