{"cve":"CVE-2022-21667","nvd":{"published":"2022-01-10T14:12:31.747","modified":"2026-06-17T04:26:43.300","status":"Modified","description":"soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an empty body, even unauthenticated with the Pusher Protocol, it will crash the server. All users that run the server are affected by this vulnerability and it's highly recommended to upgrade to the latest patch. There are no workarounds for this issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-755"],"references":["https://github.com/soketi/soketi/commit/4b12efef9c31117c36a0a0f1c3aa32114e86364b","https://github.com/soketi/soketi/releases/tag/0.24.1","https://github.com/soketi/soketi/security/advisories/GHSA-86ch-6w7v-v6xf","https://github.com/soketi/soketi/commit/4b12efef9c31117c36a0a0f1c3aa32114e86364b","https://github.com/soketi/soketi/releases/tag/0.24.1"],"products":["soketi_project:soketi"],"source":"nvd","synced_at":"2026-10-19T21:26:33.761856376+00:00"},"epss":{"cve":"CVE-2022-21667","score":0.01676,"percentile":0.76885,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-86ch-6w7v-v6xf","url":"https://osv.dev/vulnerability/GHSA-86ch-6w7v-v6xf","summary":"Denial of Service in soketi","modified":"2023-11-08T04:08:06.935571Z","packages":[{"ecosystem":"npm","name":"@soketi/soketi","purl":"pkg:npm/%40soketi/soketi","ranges":["<0.24.1"],"fixed":["0.24.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}