CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2023-32695
High (7.5) in socket socket.io-parser. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in socket.io-parser 3.3.4, 3.4.3, 4.2.3.
socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-754, CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- socket:socket.io-parser
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cqmj-92xf-r6r9 | npm | socket.io-parser | >=4.0.4 <4.2.3 | 4.2.3 |
| GHSA-cqmj-92xf-r6r9 | npm | socket.io-parser | >=3.4.0 <3.4.3 | 3.4.3 |
| GHSA-cqmj-92xf-r6r9 | npm | socket.io-parser | <3.3.4 | 3.3.4 |
References
- https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced
- https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3
- https://github.com/socketio/socket.io-parser/releases/tag/4.2.3
- https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9
- https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced