Design/Logic Flaw

2023-09-2906:15:00

PRIOn knowledge base

www.prio-n.com

design flaw

logic flaw

denial-of-service

nodebb

socket.io messages

unauthenticated attackers

crafted messages

EPSS

0.001

Percentile

24.2%

JSON

Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking eventName.startsWith() or eventName.toString(), while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively.