Описание
socket.io has an unhandled 'error' event
Impact
A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.
Affected versions
| Version range | Needs minor update? |
|---|---|
4.6.2...latest | Nothing to do |
3.0.0...4.6.1 | Please upgrade to socket.io@4.6.2 (at least) |
2.3.0...2.5.0 | Please upgrade to socket.io@2.5.1 |
Patches
This issue is fixed by https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115, included in socket.io@4.6.2 (released in May 2023).
The fix was backported in the 2.x branch today: https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c
Workarounds
As a workaround for the affected versions of the socket.io package, you can attach a listener for the "error" event:
For more information
If you have any questions or comments about this advisory:
- Open a discussion here
Thanks a lot to Paul Taylor for the responsible disclosure.
References
Ссылки
Пакеты
socket.io
< 2.5.0
2.5.1
socket.io
>= 3.0.0, < 4.6.2
4.6.2
Связанные уязвимости
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.
