CVE-2023-30591CWE-241

NodeBB Pre-Authentication Denial-of-Service

High · published September 29, 2023

Patch now

High probability of exploitation

CVSS calls it high at 7.5. It sits in the 99.1th percentile for exploit probability.

CVSS v3.1
7.5
EPSS
59%
Percentile
99.1
In the wild
Unconfirmed
What it is

Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.58692 · 99.1th percentile
Weakness
CWE-241 · Improper Handling of Unexpected Data Type
Published
2023-09-29T05:06Z
EPSS history
Timeline
  • 29 SEP 05:06Z
    NodeBB Pre-Authentication Denial-of-Service
    cvelistv5