-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| socket.io-parser | npm | < 3.3.2 | 3.3.2 |
| socket.io-parser | npm | = 3.4.0 | 3.4.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the decodeString function's handling of packet parsing. The original implementation used iterative string concatenation (buf += str.charAt(i)) in multiple parsing contexts (binary attachments, namespaces, IDs), which creates O(n²) memory overhead for large inputs. The commit dcb942d replaced these with substring operations, confirming these were the vulnerable paths. The CVE description explicitly mentions concatenation approach as the root cause, and the researcher's blog post demonstrates how these code patterns lead to memory exhaustion.
JavaScriptJavaScriptOngoing coverage of React2Shell