| Package | Affected versions | Patched versions |
|---|---|---|
| socket.io-parser | ≥ 3.4.0, < 3.4.3≥ 4.0.4, < 4.2.3 | 3.4.34.2.3 |
| socket.io-parser | ≥ 3.4.0, < 3.4.3≥ 4.0.4, < 4.2.3< 3.3.4 | 3.4.34.2.33.3.4 |
A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.
TypeError: Cannot convert object to primitive value
at Socket.emit (node:events:507:25)
at .../node_modules/socket.io/lib/socket.js:531:14
A fix has been released today (2023/05/22):
[email protected][email protected]Another fix has been released for the 3.3.x branch:
socket.io version | socket.io-parser version | Needs minor update? |
|---|---|---|
4.5.2...latest | ~4.2.0 (ref) | npm audit fix should be sufficient |
4.1.3...4.5.1 | ~4.1.1 (ref) | Please upgrade to [email protected] |
3.0.5...4.1.2 | ~4.0.3 (ref) | Please upgrade to [email protected] |
3.0.0...3.0.4 | ~4.0.1 (ref) |
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freePlease upgrade to [email protected] |
2.3.0...2.5.0 | ~3.4.0 (ref) | npm audit fix should be sufficient |
There is no known workaround except upgrading to a safe version.
If you have any questions or comments about this advisory:
Thanks to @rafax00 for the responsible disclosure.