Socket.IO vulnerabilities and security advisories

$ latest 3 · 1 critical, high or exploited

• mediumJun 19, 2024

  socket.io has an unhandled 'error' event

  • socket.io >= 3.0.0, < 4.6.2 · fixed in 4.6.2
  • socket.io < 2.5.1 · fixed in 2.5.1
  GHSA-25hc-qcg6-38wjCVE-2024-38355

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-25hc-qcg6-38wj (CVE-2024-38355), severity medium
  What it is: socket.io has an unhandled 'error' event
  Affected packages:
  - socket.io: affected versions >= 3.0.0, < 4.6.2. Fixed in 4.6.2.
  - socket.io: affected versions < 2.5.1. Fixed in 2.5.1.
  Details: https://github.com/advisories/GHSA-25hc-qcg6-38wj
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumJan 20, 2021

  CORS misconfiguration in socket.io

  • socket.io < 2.4.0 · fixed in 2.4.0
  GHSA-fxwf-4rqh-v8g3CVE-2020-28481

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-fxwf-4rqh-v8g3 (CVE-2020-28481), severity medium
  What it is: CORS misconfiguration in socket.io
  Affected packages:
  - socket.io: affected versions < 2.4.0. Fixed in 2.4.0.
  Details: https://github.com/advisories/GHSA-fxwf-4rqh-v8g3
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• highNov 7, 2018

  Insecure randomness in socket.io

  • socket.io <= 0.9.6 · fixed in 0.9.7
  GHSA-qv2v-m59f-v5fwCVE-2017-16031

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-qv2v-m59f-v5fw (CVE-2017-16031), severity high
  What it is: Insecure randomness in socket.io
  Affected packages:
  - socket.io: affected versions <= 0.9.6. Fixed in 0.9.7.
  Details: https://github.com/advisories/GHSA-qv2v-m59f-v5fw
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

From the GitHub Advisory Database, refreshed hourly. Full history on GitHub.