-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient input validation in Socket.IO's packet decoding logic. Patches introduced the isPayloadValid() function to enforce strict type checks on event names. The decodeString function (called by Decoder.add) previously allowed arrays with non-primitive first elements as event names. When such malformed packets were emitted via Socket.emit(), JavaScript's type coercion failed, causing uncaught exceptions. The commit diffs show these functions were modified to add validation, confirming their role in the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| socket.io-parser | npm | >= 3.4.0, < 3.4.3 | 3.4.3 |
| socket.io-parser | npm | >= 4.0.4, < 4.2.3 | 4.2.3 |
| socket.io-parser | npm | < 3.3.4 | 3.3.4 |