Vulnerability · Published May 27, 2023 · Assigned by GitHub_M
CVE-2023-32695Insufficient validation when decoding a Socket.IO packet
High 7.3
In plain English
A high-severity improper input validation in socket.io-parser from socketio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-socket.io-parser | 4.2.1+~3.1.0-2 | DEBIAN-CVE-2023-32695 |
| Debian:13 | node-socket.io-parser | 4.2.1+~3.1.0-2 | DEBIAN-CVE-2023-32695 |
| Debian:14 | node-socket.io-parser | 4.2.1+~3.1.0-2 | DEBIAN-CVE-2023-32695 |
| Ubuntu:22.04:LTS | node-socket.io-parser | no fix listed | UBUNTU-CVE-2023-32695 |
| Ubuntu:24.04:LTS | node-socket.io-parser | no fix listed | UBUNTU-CVE-2023-32695 |
| npm | socket.io-parser | 3.3.4 | GHSA-cqmj-92xf-r6r9 |
| npm | socket.io-parser | 3.4.3 | GHSA-cqmj-92xf-r6r9 |
| npm | socket.io-parser | 4.2.3 | GHSA-cqmj-92xf-r6r9 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| socketio | socket.io-parser | >= 4.0.0, < 4.2.3>= 3.4.0, < 3.4.3 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
References
- https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9 x_refsource_CONFIRM
- https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced x_refsource_MISC
- https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3 x_refsource_MISC
- https://github.com/socketio/socket.io-parser/releases/tag/4.2.3 x_refsource_MISC