CVE-2023-37899

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like const message = $ toString: '' which would cause the NodeJS process to crash when sending an unexpected Socket.io...

@ir-engine/server-core (1.6.0), @ir-engine/taskserver (1.6.0) +2 more potentially affected by CVE-2023-37899 via @feathersjs/transport-commons (>=5.0.0-pre.9, <=5.0.5)

@feathersjs/transport-commons NPM version =5.0.0-pre.9, =0.4.11, =0.5.4, =0.5.8 Source cves: CVE-2023-37899 Source advisory: OSV:GHSA-HHR9-RH25-HVF9...

@z1/lib-api-box-client (>=0.2.1, <=0.3.0), @z1/lib-api-box-client-core (>=0.2.0, <=0.3.0) +9 more potentially affected by CVE-2023-37899 via @feathersjs/transport-commons (4.2.1)

@feathersjs/transport-commons NPM version 4.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on @feathersjs/transport-commons and may be impacted: - @z1/lib-api-box-client =0.2.1, =0.2.0, =0.2.0, =0.2.1, =0.2.1, =0.2.1, =0.2.1, =0.2.1, =0.2.52, =0.2.52...

@xr3ngine/client-core (>=0.2.15, <=0.2.18), @xr3ngine/client-ml (>=0.2.15, <=0.2.18) +1 more potentially affected by CVE-2023-37899 via @feathersjs/socketio (>=4.5.9, <=4.5.11)

@feathersjs/socketio NPM version =4.5.9, =0.2.15, =0.2.15, =0.2.18 - @xr3ngine/server-core 0.2.14 Source cves: CVE-2023-37899 Source advisory: OSV:GHSA-HHR9-RH25-HVF9...

CVE-2023-37899

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like const message = $ toString: '' which would cause the NodeJS process to crash when sending an unexpected Socket.io...

CVE-2023-37899

CVE-2023-37899 concerns Feathersjs: the socket handler fails to catch invalid string conversion errors (e.g., a crafted toString object), causing Node.js to crash on unexpected Socket.io messages. A fix is available in Feathers versions 5.0.8 and 4.5.18; users should upgrade. There is no known wo...