{"id":"CVE-2023-32695","published":"2023-05-27T15:44:03Z","modified":"2025-01-13T21:03:34Z","title":"Insufficient validation when decoding a Socket.IO packet","vendor":"socketio","product":"socket.io-parser","tier":"tail","description":{"text":"socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.\n\n","provenance":"source","from":"CVE.org"},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01059,"percentile":0.64545,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced","tags":["x_refsource_MISC"]},{"url":"https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3","tags":["x_refsource_MISC"]},{"url":"https://github.com/socketio/socket.io-parser/releases/tag/4.2.3","tags":["x_refsource_MISC"]}],"priority":{"score":18.0,"factors":[{"name":"EPSS percentile","points":12.91},{"name":"CVSS severity","points":5.11}]},"vendorSlug":"socketio","affectedVersions":[{"vendor":"socketio","product":"socket.io-parser","versions":[">= 4.0.0, < 4.2.3",">= 3.4.0, < 3.4.3"]}],"affected":[{"ecosystem":"npm","package":"socket.io-parser","vulnerableRanges":[">=4.0.4, <4.2.3",">=3.4.0, <3.4.3","<3.3.4"],"patched":["4.2.3","3.4.3","3.3.4"],"from":["GHSA-cqmj-92xf-r6r9"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1528","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-36049","published":"2021-01-07","fixed":"3.4.1","kev":false},{"cve":"CVE-2022-2421","published":"2022-10-25","fixed":"4.2.1","kev":false,"link":{"from":"CVE-2022-2421","to":"CVE-2023-32695","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:socket.io-parser","fromFixed":"4.2.1","toFixed":"4.2.3","daysApart":214},{"kind":"version-step","provenance":"source","package":"npm:socket.io-parser","fromFixed":"3.4.2","toFixed":"3.4.3","daysApart":214}]}},{"cve":"CVE-2023-32695","published":"2023-05-27","fixed":"4.2.3","kev":false},{"cve":"CVE-2026-33151","published":"2026-03-20","fixed":"4.2.6","kev":false},{"cve":"CVE-2026-69185","published":"2026-08-03","fixed":"4.2.7","kev":false}],"package":"npm:socket.io-parser"}}