Resource exhaustion in socket.io-parser

Description

The socket.io-parser npm package before versions 3.3.2 and 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.

Recommendation

Update the socket.io-parser package to the latest compatible version. Followings are version details:

• Affected version(s): **= 3.4.0

  < 3.3.2**

• Patched version(s): **3.4.1

  3.3.2**

References

• GHSA-xfhh-g9f5-x4m4
• blog.caller.xyz
• www.npmjs.com
• CVE-2020-36049
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Socket.IO: Zero-attachment Memory Exhaustion - CVE-2026-69185
• Insufficient validation when decoding a Socket.IO packet - socket.io-parser - CVE-2022-2421
• Resource exhaustion in engine.io - CVE-2020-36048
• Command Injection in hot-formula-parser - CVE-2020-6836

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

socket.io-parser