| Package | Affected versions | Patched versions |
|---|---|---|
| socket.io-parser | ≥ 3.4.0, < 3.4.5≥ 4.0.0, < 4.2.7< 3.3.6 | 3.4.54.2.73.3.6 |
A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.
| Version range | Used by | Fixed version |
|---|---|---|
>=4.0.0 <4.2.7 | [email protected] and [email protected] | 4.2.7 |
>=3.4.0 <3.4.5 | [email protected] | 3.4.5 |
<3.3.6 | [email protected] | 3.3.6 |
There is no known workaround except upgrading to a safe version.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free