Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. Patches | Version range | Used by | Fixed version | |------------------|--------------------------------------------|---------------| | =4.0.0 <4.2.7 | socket.io@4.x and socket.io-client@4.x | 4.2.7 | | =3.4.0 <3.4.5 | socket.io@2.x | 3.4.5 | | <3.3.6 | socket.io-client@2.x | 3.3.6 | Workarounds There is no known workaround except upgrading to a safe version. For more information If you have any questions or comments about this advisory: - Open a discussion here
Recommended action: Upgrade to 4.2.7, 3.4.5 or 3.3.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. Patches | Version range | Used by | Fixed version | |------------------|--------------------------------------------|---------------| | =4.0.0 <4.2.6 | socket.io@4.x and socket.io-client@4.x | 4.2.6 | | =3.4.0 <3.4.4 | socket.io@2.x | 3.4.4 | | <3.3.5 | socket.io-client@2.x | 3.3.5 | Workarounds There is no known workaround except upgrading to a safe version. For more information If you have any questions or comments about this advisory: - Open a discussion here
Recommended action: Upgrade to 4.2.6, 3.4.4 or 3.3.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. Patches A fix has been released today (2023/05/22): - https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3, included in socket.io-parser@4.2.3 - https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced, included in socket.io-parser@3.4.3 Another fix has been released for the 3.3.x branch: - https://github.com/socketio/socket.io-parser/commit/ee006607495eca4ec7262ad080dd3a91439a5ba4, included in socket.io-parser@3.3.4 | socket.io version | socket.io-parser version | Needs minor update? | |---------------------|---------------------------------------------------------------------------------------------------------|--------------------------------------| | 4.5.2...latest | ~4.2.0 (ref) | npm audit fix should be sufficient | | 4.1.3...4.5.1 | ~4.1.1 (ref) | Please upgrade to…
Recommended action: Upgrade to 4.2.3, 3.4.3 or 3.3.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Due to improper type validation in the socket.io-parser library (which is used by the socket.io and socket.io-client packages to encode and decode Socket.IO packets), it is possible to overwrite the placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object. Example: This bubbles up in the socket.io package: :warning: IMPORTANT NOTE :warning: You need to make sure that the payload that you received from the client is actually a Buffer object: If that's already the case, then you are not impacted by this issue, and there is no way an attacker could make your server crash (or escalate privileges, ...). Example of values that could be sent by a malicious user: - a number that is out of bounds Sample packet: 451-["hello",{"placeholder":true,"num":10}] - a value that is not a number, like undefined Sample packet: 451-["hello",{"placeholder":true,"num":undefined}] - a string that is part of the prototype of Array, like…
Recommended action: Upgrade to 4.2.1, 4.0.5, 3.4.2 or 3.3.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The socket.io-parser npm package before versions 3.3.2 and 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
Recommended action: Upgrade to 3.4.1 or 3.3.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.