Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@feathersjs/socketio

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5npmAmendedPublished

    Feathers socket handler allows abusing implicit toString

    CVE-2023-37899 · GHSA-hhr9-rh25-hvf9

    Affected
    • npm @feathersjs/socketio <= 4.5.17; >= 5.0.0, <= 5.0.7
    Fixed in
    5.0.84.5.18· Vendor fix available
    Issue
    Impact Feathers socket handler did not catch invalid string conversion errors like: Causing the NodeJS process to crash when sending an unexpected Socket.io message like Patches A fix has been released in - v5.0.8 via #3241 - v4.5.18 via #3242 Workarounds Since it is in the core Socket handling code upgrading to the latest version is necessary. References - v5.0.8 Changelog - v4.5.18 Changelog

    Recommended action: Upgrade to 5.0.8 or 4.5.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →