| Package | Affected versions | Patched versions |
|---|---|---|
| feathers | ≥ 5.0.0, < 5.0.8< 4.5.18 | 5.0.84.5.18 |
| @feathersjs/socketio | ≥ 5.0.0, < 5.0.8< 4.5.18 | 5.0.84.5.18 |
| @feathersjs/transport-commons | ≥ 5.0.0, < 5.0.8< 4.5.18 | 5.0.84.5.18 |
Feathers socket handler did not catch invalid string conversion errors like:
const message = `${{ toString: '' }}`
Causing the NodeJS process to crash when sending an unexpected Socket.io message like
socket.emit('find', { toString: '' })
A fix has been released in
v5.0.8 via #3241v4.5.18 via #3242Since it is in the core Socket handling code upgrading to the latest version is necessary.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free