CVE-2023-32695

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.

Database specific

{
    "cwe_ids": [
        "CWE-20"
    ]
}

References

Affected packages

Git / github.com/socketio/socket.io-parser

Affected ranges

Type

GIT

Repo

https://github.com/socketio/socket.io-parser

Events

Introduced

c04d7f5c47ed712eb0f56cfc1a859f1aaa828f1e

Fixed

b6c824f82421aa44dfd5ef395f5132866543de59

Database specific

{
    "versions": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.2.3"
        }
    ]
}

Type

GIT

Repo

https://github.com/socketio/socket.io-parser

Events

Introduced

652402a8568c2138da3c27c96756b32efca6c4bf

Fixed

060339a206268d8860d82aa3c0766e867ce5bb8a

Database specific

{
    "versions": [
        {
            "introduced": "3.4.0"
        },
        {
            "fixed": "3.4.3"
        }
    ]
}

Affected versions

3.*

3.4.0

3.4.1

3.4.2

4.*

4.0.0

4.0.1

4.0.1-rc1

4.0.1-rc2

4.0.1-rc3

4.0.2

4.0.3

4.0.4

4.1.0

4.1.1

4.1.2

4.2.0

4.2.1

4.2.2