CVE-2023-32695

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.

References

Affected packages

Debian:12 / node-socket.io-parser

Package

Name: node-socket.io-parser
Purl: pkg:deb/debian/node-socket.io-parser?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.2.1+~3.1.0-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / node-socket.io-parser

Package

Name: node-socket.io-parser
Purl: pkg:deb/debian/node-socket.io-parser?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.2.1+~3.1.0-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/socketio/socket.io-parser

Affected ranges

Type: GIT
Repo: https://github.com/socketio/socket.io-parser
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

2dc3c92622dad113b8676be06f23b1ed46b02ced

Fixed

3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3

Affected versions

2.*

2.0.0

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.2.6

2.3.0

2.3.1

2.3.2

3.*

3.0.0

3.1.0

3.1.1

3.1.2

3.1.3

3.2.0

3.3.0

3.4.0

3.4.1

3.4.2

4.*

4.0.0

4.0.1

4.0.1-rc1

4.0.1-rc2

4.0.1-rc3

4.0.2

4.0.3

4.0.4

4.1.0

4.1.1

4.1.2

4.2.0

4.2.1

4.2.2