TI-2022-09431 Aliases CVE-2022-25867 GHSA-85xx-xhjm-rhrw

NULL pointer dereference in io.socket:socket.io-client

LOW 36CWE-476Published 2022-08-02 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-476.

Summary

The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format.

Why it matters now

EPSS 0.01652 76th percentileScored 2026-11-07

Fix Fixed io.socket:socket.io-client: 2.0.1io.socket:socket.io-client (Maven): 2.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	io.socket:socket.io-client	before 2.0.1	2.0.1	Patch available	CNA
—	io.socket:socket.io-client (Maven)	before 2.0.1	2.0.1	Patch available	GHSA-85xx-xhjm-rhrw

io.socket:socket.io-client Vendor— Affected before 2.0.1 Fixed in 2.0.1 Patch available CNA
io.socket:socket.io-client (Maven) Vendor— Affected before 2.0.1 Fixed in 2.0.1 Patch available GHSA-85xx-xhjm-rhrw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:socket:socket.io-client_java::::::::	before 2.0.1	Vulnerable	socketio

cpe:2.3:a:socket:socket.io-client_java:*:*:*:*:*:*:*:* Versions before 2.0.1 Vulnerable ·socketio

Remediation

Fix · CNA io.socket:socket.io-client Fixed in 2.0.1
Fix · GHSA-85xx-xhjm-rhrw io.socket:socket.io-client (Maven) Fixed in 2.0.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-25867
2026-10-03 Alias added: GHSA-85xx-xhjm-rhrw

References

Patch 2

Advisory 3

Other 1

https://github.com/socketio/socket.io-client-java

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences