CVE-2024-38355 Unhandled 'error' event in socket.io

2024-06-1919:48:50

CWE-754

CWE-20

GitHub_M

www.cve.org

socket.io

real-time communication

security vulnerability

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

0.0004 Low

EPSS

Percentile

15.7%

JSON

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit 15af22fc22 which has been included in [email protected] (released in May 2023). The fix was backported in the 2.x branch as well with commit d30630ba10. Users are advised to upgrade. Users unable to upgrade may attach a listener for the “error” event to catch these errors.

CNA Affected

[
  {
    "vendor": "socketio",
    "product": "socket.io",
    "versions": [
      {
        "version": "< 2.5.1",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0,< 4.6.2",
        "status": "affected"
      }
    ]
  }
]