CVE-2024-38355CWE-20CWE-754

Unhandled 'error' event in socket.io

High · published June 19, 2024

CVSS v3.1
7.3
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `[email protected]` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00807 · 56.4th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2024-06-19T19:48Z
EPSS history
Timeline
  • 19 JUN 19:48Z
    Unhandled 'error' event in socket.io
    cvelistv5