Description
The socket.io-parser npm package before versions 3.3.2 and 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
Recommendation
Update the socket.io-parser package to the latest compatible version. Followings are version details:
Affected version(s): **= 3.4.0 < 3.3.2** Patched version(s): **3.4.1 3.3.2**
References
Could your website be exposed too?
SmartScanner can check your website for Resource exhaustion in socket.io-parser and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Socket.IO: Zero-attachment Memory Exhaustion - CVE-2026-69185
- Insufficient validation when decoding a Socket.IO packet - socket.io-parser - CVE-2022-2421
- Resource exhaustion in engine.io - CVE-2020-36048
- Command Injection in hot-formula-parser - CVE-2020-6836
You might also like:
See something that needs correcting? Let us knowUpdated February 01, 2023