Insufficient validation when decoding a Socket.IO packet - socket.io-parser

Description

Due to improper type validation in the socket.io-parser library (which is used by the socket.io and socket.io-client packages to encode and decode Socket.IO packets), it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.

Recommendation

Update the socket.io-parser package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 3.4.0, < 3.4.2

  < 3.3.3

  >= 4.0.0, < 4.0.5

  >= 4.1.0, < 4.2.1**

• Patched version(s): **3.4.2

  3.3.3

  4.0.5

  4.2.1**

References

• GHSA-qm95-pgcg-qqfq
• csirt.divd.nl
• CVE-2022-2421
• CWE-1287
• CWE-20
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Insufficient validation when decoding a Socket.IO packet - CVE-2023-32695
• matrix-js-sdk has insufficient validation when considering a room to be upgraded by another - CVE-2025-59160
• Resource exhaustion in socket.io-parser - CVE-2020-36049
• ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse` - CVE-2020-28462

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

socket.io-parser