Lucene search

PRIOn knowledge basePRION:CVE-2023-32695

HistoryMay 27, 2023 - 4:15 p.m.

Design/Logic Flaw

2023-05-2716:15:00

PRIOn knowledge base

www.prio-n.com

socket.io

parser

logic flaw

version 5

javascript

node.js

patch

nvd

7.5 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.4%

JSON

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.

CPENameOperatorVersion
socket.io-parserge4.0.4
socket.io-parserlt4.2.3
socket.io-parserge3.4.0
socket.io-parserlt3.4.3

Name	Operator	Version
socket.io-parser	ge	4.0.4
socket.io-parser	lt	4.2.3
socket.io-parser	ge	3.4.0
socket.io-parser	lt	3.4.3

References

github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced

github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3

github.com/socketio/socket.io-parser/releases/tag/4.2.3

github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9