CVE-2023-32695

HIGH EPSS 60.3%
Published May 27, 20233y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published May 27, 2023 3y ago
Last Modified Jun 17, 2026 2w ago

Description

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
60.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-20 Improper Input Validation Validation
CWE-754

Affected Products 2

VendorProductVersionRange
socketsocket.io-parser*≥3.4.0  –  <3.4.3
socketsocket.io-parser*≥4.0.4  –  <4.2.3

References 4

  • github.com https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced
    Patch
  • github.com https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3
    Patch
  • github.com https://github.com/socketio/socket.io-parser/releases/tag/4.2.3
    Release Notes
  • github.com https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9
    Vendor Advisory

Remediation

  • github.com https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced
    Patch
  • github.com https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3
    Patch