Vendors / socketio Records 19 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 15
Exploited now socketio records in CISA KEV No socketio vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 52
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the res…
CVSS 3.1 CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.01431 · Published 2022-10-25 · Fixed in 4.2.1, 4.0.5 +2 CWE-89
Priority MEDIUM 44
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework.
CVSS 4.0 HIGH 8.7· Network · No auth · No interaction · EPSS 0.00535 · Published 2026-03-20 · Partial fix · 3.3.5, 3.4.4 +1 CWE-20
Priority MEDIUM 41
socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.01059 · Published 2023-05-27 · Fixed in 4.2.3, 3.4.3 +1 CWE-20
Priority LOW 38
socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.02671 · Published 2021-01-07 · Partial fix · 3.3.2, 3.4.1 CWE-770
Open these records in search → All records by CVSS severity
1 15 3 0 0
THREATIST.IORead the docs