DoS vulnerability for apps with sockets enabled

高危 7.5CVE-2023-38504 · GHSA-gpw9-fwm8-7rx7 · Published 27/07/2023 · updated 17/06/2026

要点

CVE-2023-38504 是影响 sails (sailsjs), sails 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.94%，高于 61.0% 的漏洞。
修复：升级到 1.5.7 或更高版本。

Package	Affected versions	Patched versions
sails sailsjs	`< 1.5.7`	`1.5.7`
sails npm	`< 1.5.7`	`1.5.7`

Description

Impact

In Sails apps <=v1.5.6, an attacker can send a virtual request that will cause the node process to crash.

Patches

This behavior was fixed in Sails v1.5.7

Workarounds

Disable the sockets hook and remove the sails.io.js client

References

https://github.com/balderdashy/sails/pull/7287

Big thanks to @ThomasRinsma at Codean!

NVD description

Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7,, an attacker can send a virtual request that will cause the node process to crash. This behavior was fixed in Sails v1.5.7. As a workaround, disable the sockets hook and remove the `sails.io.js` client.

References

balderdashy/sails security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2023-38504 · ADVISORY
balderdashy/sails#7287 · WEB
balderdashy/sails commit 4a023dc · WEB
balderdashy/sails · PACKAGE
balderdashy/sails release v1.5.7 · WEB

sails 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

sails

sailsjs

< 1.5.7

1.5.7

sails

npm

< 1.5.7

1.5.7

Description

Impact

In Sails apps <=v1.5.6, an attacker can send a virtual request that will cause the node process to crash.

Patches

This behavior was fixed in Sails v1.5.7

Workarounds

Disable the sockets hook and remove the sails.io.js client

References

https://github.com/balderdashy/sails/pull/7287

Big thanks to @ThomasRinsma at Codean!

NVD description

sails 的其他漏洞

查看全部 →