Insecure Defaults

Overview socket.io is a node.js realtime framework server. Affected versions of this package are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default. Remediation Upgrade socket.io to version 2.4.0 or higher. References - GitHub Issue - HackerOne...