socket.io-parser vulnerabilities

Socket.IO: Zero-attachment Memory Exhaustion

Affected

>=4.0.0 <4.2.7 · >=3.4.0 <3.4.5 · <3.3.6

Fixed in

3.3.6, 3.4.5, 4.2.7

socket.io allows an unbounded number of binary attachments

Affected

<3.3.5 · >=3.4.0 <3.4.4 · >=4.0.0 <4.2.6

Fixed in

3.3.5, 3.4.4, 4.2.6

Insufficient validation when decoding a Socket.IO packet

Affected

>=4.0.4 <4.2.3 · >=3.4.0 <3.4.3 · <3.3.4

Fixed in

3.3.4, 3.4.3, 4.2.3

Insufficient validation when decoding a Socket.IO packet

Affected

>=4.0.0 <4.0.5 · >=4.1.0 <4.2.1 · <3.3.3 · >=3.4.0 <3.4.2

Fixed in

3.3.3, 3.4.2, 4.0.5, 4.2.1

Resource exhaustion in socket.io-parser

Affected

<3.3.2 · >=3.4.0 <3.4.1

Fixed in

3.3.2, 3.4.1