HighGHSA-xfhh-g9f5-x4m4CVE-2020-36049
Resource exhaustion in socket.io-parser
Published 30 Jun 2021 · Updated 8 Nov 2023
Affected packages
- Affected
- <3.3.2
- Fixed in
- 3.3.2
Update to the fixed version for your release line, for example:
npm install socket.io-parser@3.3.2- Affected
- >=3.4.0 <3.4.1
- Fixed in
- 3.4.1
Update to the fixed version for your release line, for example:
npm install socket.io-parser@3.4.1Details
The socket.io-parser npm package before versions 3.3.2 and 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
Is GHSA-xfhh-g9f5-x4m4 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected socket.io-parser, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2020-36049
- Linkgithub.com/socketio/socket.io-parser/commit/dcb942d24db97162ad16a67c2a0cf30875342d55
- Linkblog.caller.xyz/socketio-engineio-dos
- Linkgithub.com/bcaller/kill-engine-io
- Linkgithub.com/socketio/socket.io-parser/releases/tag/3.3.2
- Linkgithub.com/socketio/socket.io-parser/releases/tag/3.4.1
- Linkwww.npmjs.com/package/socket.io-parser
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.