Go to packages list

socket-io-parser

Ecosystem: npm

Downloads:

Vulnerabilities from the last (months)
  • 1CriticalAffects 4 versions
  • 3HighAffects 8 versions
  • 0MediumAffects 0 versions
  • 1ModerateAffects 3 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
5vulnerabilities
  • Critical1 (20.0%)
  • High3 (60.0%)
  • Medium0 (0.0%)
  • Moderate1 (20.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 1
    • High: 0
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (5)

Known vulnerabilities affecting socket-io-parser, based on data from OSV.

Vulnerabilities affecting socket-io-parser
IDSeveritySummaryAffected versionsPublishedSource
GHSA-2m8v-j782-fhvrHighSocket.IO: Zero-attachment Memory Exhaustion### Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. ### Patches | Version range | Used by | Fixed version | |------------------|--------------------------------------------|---------------| | `>=4.0.0 <4.2.7` | `socket.io@4.x` and `socket.io-client@4.x` | `4.2.7` | | `>=3.4.0 <3.4.5` | `socket.io@2.x` | `3.4.5` | | `<3.3.6` | `socket.io-client@2.x` |
  • >= 4.0.0, < 4.2.7
  • >= 3.4.0, < 3.4.5
  • < 3.3.6
GitHub (opens in a new tab)
GHSA-677m-j7p3-52f9Highsocket.io allows an unbounded number of binary attachments### Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. ### Patches | Version range | Used by | Fixed version | |------------------|--------------------------------------------|---------------| | `>=4.0.0 <4.2.6` | `socket.io@4.x` and `socket.io-client@4.x` | `4.2.6` | | `>=3.4.0 <3.4.4` | `socket.io@2.x` | `3.4.4` | | `<3.3.5` | `socket.io-client@2.x` |
  • < 3.3.5
  • >= 3.4.0, < 3.4.4
  • >= 4.0.0, < 4.2.6
GitHub (opens in a new tab)
GHSA-cqmj-92xf-r6r9ModerateInsufficient validation when decoding a Socket.IO packet### Impact A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. ``` TypeError: Cannot convert object to primitive value at Socket.emit (node:events:507:25) at .../node_modules/socket.io/lib/socket.js:531:14 ``` ### Patches A fix has been released today (2023/05/22): - https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3, included in `socket.io-parser@4.2.3` - https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced, included
  • >= 4.0.4, < 4.2.3
  • >= 3.4.0, < 3.4.3
  • < 3.3.4
GitHub (opens in a new tab)
GHSA-qm95-pgcg-qqfqCriticalInsufficient validation when decoding a Socket.IO packetDue to improper type validation in the `socket.io-parser` library (which is used by the `socket.io` and `socket.io-client` packages to encode and decode Socket.IO packets), it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object. Example: ```js const decoder = new Decoder(); decoder.on("decoded", (packet) => { console.log(packet.data); // prints [ 'hello', [Function: splice] ] }) decoder.add('51-["hello",{"_placeholder":true,"num":"splice"}]'); decoder.add(Buffer.from("world")); ``` Th
  • >= 4.0.0, < 4.0.5
  • >= 4.1.0, < 4.2.1
  • < 3.3.3
  • >= 3.4.0, < 3.4.2
GitHub (opens in a new tab)
GHSA-xfhh-g9f5-x4m4HighResource exhaustion in socket.io-parserThe `socket.io-parser` npm package before versions 3.3.2 and 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
  • < 3.3.2
  • >= 3.4.0, < 3.4.1
GitHub (opens in a new tab)
  • GHSA-2m8v-j782-fhvrHigh
    Socket.IO: Zero-attachment Memory Exhaustion
    • >= 4.0.0, < 4.2.7
    • >= 3.4.0, < 3.4.5
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 4.0.0, < 4.2.7
    • >= 3.4.0, < 3.4.5
    • < 3.3.6

    ### Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. ### Patches | Version range | Used by | Fixed version | |------------------|--------------------------------------------|---------------| | `>=4.0.0 <4.2.7` | `socket.io@4.x` and `socket.io-client@4.x` | `4.2.7` | | `>=3.4.0 <3.4.5` | `socket.io@2.x` | `3.4.5` | | `<3.3.6` | `socket.io-client@2.x` |

    CVE: CVE-2026-69185

  • GHSA-677m-j7p3-52f9High
    socket.io allows an unbounded number of binary attachments
    • < 3.3.5
    • >= 3.4.0, < 3.4.4
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • < 3.3.5
    • >= 3.4.0, < 3.4.4
    • >= 4.0.0, < 4.2.6

    ### Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. ### Patches | Version range | Used by | Fixed version | |------------------|--------------------------------------------|---------------| | `>=4.0.0 <4.2.6` | `socket.io@4.x` and `socket.io-client@4.x` | `4.2.6` | | `>=3.4.0 <3.4.4` | `socket.io@2.x` | `3.4.4` | | `<3.3.5` | `socket.io-client@2.x` |

    CVE: CVE-2026-33151

  • GHSA-cqmj-92xf-r6r9Moderate
    Insufficient validation when decoding a Socket.IO packet
    • >= 4.0.4, < 4.2.3
    • >= 3.4.0, < 3.4.3
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 4.0.4, < 4.2.3
    • >= 3.4.0, < 3.4.3
    • < 3.3.4

    ### Impact A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. ``` TypeError: Cannot convert object to primitive value at Socket.emit (node:events:507:25) at .../node_modules/socket.io/lib/socket.js:531:14 ``` ### Patches A fix has been released today (2023/05/22): - https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3, included in `socket.io-parser@4.2.3` - https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced, included

    CVE: CVE-2023-32695

  • GHSA-qm95-pgcg-qqfqCritical
    Insufficient validation when decoding a Socket.IO packet
    • >= 4.0.0, < 4.0.5
    • >= 4.1.0, < 4.2.1
    • +2 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 4.0.0, < 4.0.5
    • >= 4.1.0, < 4.2.1
    • < 3.3.3
    • >= 3.4.0, < 3.4.2

    Due to improper type validation in the `socket.io-parser` library (which is used by the `socket.io` and `socket.io-client` packages to encode and decode Socket.IO packets), it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object. Example: ```js const decoder = new Decoder(); decoder.on("decoded", (packet) => { console.log(packet.data); // prints [ 'hello', [Function: splice] ] }) decoder.add('51-["hello",{"_placeholder":true,"num":"splice"}]'); decoder.add(Buffer.from("world")); ``` Th

    CVE: CVE-2022-2421

  • GHSA-xfhh-g9f5-x4m4High
    Resource exhaustion in socket.io-parser
    • < 3.3.2
    • >= 3.4.0, < 3.4.1
    GitHub (opens in a new tab)

    The `socket.io-parser` npm package before versions 3.3.2 and 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.

    CVE: CVE-2020-36049

Showing 1-5 of 5 vulnerabilities