Insufficient validation when decoding a Socket.IO packet

Description

A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.

Recommendation

Update the socket.io-parser package to the latest compatible version. Followings are version details:

• Affected version(s): **< 3.3.4

  >= 4.0.4, < 4.2.3

  >= 3.4.0, < 3.4.3**

• Patched version(s): **3.3.4

  4.2.3

  3.4.3**

References

• GHSA-cqmj-92xf-r6r9
• CVE-2023-32695
• CWE-20
• CWE-754
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Insufficient validation when decoding a Socket.IO packet - socket.io-parser - CVE-2022-2421
• matrix-js-sdk has insufficient validation when considering a room to be upgraded by another - CVE-2025-59160
• Feathers socket handler allows abusing implicit toString - CVE-2023-37899
• Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code - CVE-2023-45133

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

socket.io-parser