Read the docs
TI-2023-15971 Aliases CVE-2023-32695GHSA-cqmj-92xf-r6r9

Insufficient validation when decoding a Socket.IO packet

Priority MEDIUM 41CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01059 64th percentileScored 2026-11-07
Fix Fixed socket.io-parser (socketio): 4.2.3, 3.4.3socket.io-parser (npm): 4.2.3, 3.4.3, 3.3.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
socketiosocket.io-parser4.0.0 to before 4.2.3; 3.4.0 to before 3.4.34.2.3, 3.4.3Patch availableCNA
—socket.io-parser (npm)4.0.4 to before 4.2.34.2.3Patch availableGHSA-cqmj-92xf-r6r9
—socket.io-parser (npm)3.4.0 to before 3.4.33.4.3Patch availableGHSA-cqmj-92xf-r6r9
—socket.io-parser (npm)before 3.3.43.3.4Patch availableGHSA-cqmj-92xf-r6r9
  • socket.io-parser Vendorsocketio Affected 4.0.0 to before 4.2.3; 3.4.0 to before 3.4.3 Fixed in 4.2.3, 3.4.3 Patch available CNA
  • socket.io-parser (npm) Vendor— Affected 4.0.4 to before 4.2.3 Fixed in 4.2.3 Patch available GHSA-cqmj-92xf-r6r9
  • socket.io-parser (npm) Vendor— Affected 3.4.0 to before 3.4.3 Fixed in 3.4.3 Patch available GHSA-cqmj-92xf-r6r9
  • socket.io-parser (npm) Vendor— Affected before 3.3.4 Fixed in 3.3.4 Patch available GHSA-cqmj-92xf-r6r9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:socket:socket.io-parser:*:*:*:*:*:node.js:*:*3.4.0 to before 3.4.3; 4.0.4 to before 4.2.3Vulnerablesocketio
  • cpe:2.3:a:socket:socket.io-parser:*:*:*:*:*:node.js:*:* Versions 3.4.0 to before 3.4.3; 4.0.4 to before 4.2.3 Vulnerable ·socketio

Remediation

  • Fix · CNA socket.io-parser (socketio) Fixed in 4.2.3, 3.4.3
  • Fix · GHSA-cqmj-92xf-r6r9 socket.io-parser (npm) Fixed in 4.2.3 Advisory →
  • Fix · GHSA-cqmj-92xf-r6r9 socket.io-parser (npm) Fixed in 3.4.3 Advisory →
  • Fix · GHSA-cqmj-92xf-r6r9 socket.io-parser (npm) Fixed in 3.3.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-32695
  2. 2026-10-03 Alias added: GHSA-cqmj-92xf-r6r9

References

Patch 2

Advisory 2

Other 4

  • TI-2022-02236 Socket.io - Improper type validation in attachment parsing CVSS 3.1CRITICAL 10.0
  • TI-2026-25581 socket.io allows an unbounded number of binary attachments CVSS 4.0HIGH 8.7
  • TI-2020-18428 socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences