socket.io has an unhandled 'error' event

Description

A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.

Recommendation

Update the socket.io package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 3.0.0, < 4.6.2

  < 2.5.0**

• Patched version(s): **4.6.2

  2.5.1**

References

• GHSA-25hc-qcg6-38wj
• CVE-2024-38355
• CWE-20
• CWE-754
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• @sveltejs/kit has unescaped error message included on error page - CVE-2024-53262
• zcap has incomplete expiration checks in capability chains. - CVE-2024-31995
• CORS misconfiguration in socket.io - CVE-2020-28481
• vue-i18n has cross-site scripting vulnerability with prototype pollution - CVE-2024-52809

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

socket.io