Read the docs
TI-2024-25613 Aliases CVE-2024-38355GHSA-25hc-qcg6-38wj

Unhandled 'error' event in socket.io

Priority MEDIUM 40CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `[email protected]` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00807 57th percentileScored 2026-11-07
Fix Partial socket.io (socketio): 2.5.1, 4.6.2socket.io (npm): 2.5.1, 4.6.2Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
socketiosocket.iobefore 2.5.1; 3.0.0 to before 4.6.22.5.1, 4.6.2Patch availableCNA
—socket.io (npm)before 2.5.12.5.1Patch availableGHSA-25hc-qcg6-38wj
—socket.io (npm)3.0.0 to before 4.6.24.6.2Patch availableGHSA-25hc-qcg6-38wj
  • socket.io Vendorsocketio Affected before 2.5.1; 3.0.0 to before 4.6.2 Fixed in 2.5.1, 4.6.2 Patch available CNA
  • socket.io (npm) Vendor— Affected before 2.5.1 Fixed in 2.5.1 Patch available GHSA-25hc-qcg6-38wj
  • socket.io (npm) Vendor— Affected 3.0.0 to before 4.6.2 Fixed in 4.6.2 Patch available GHSA-25hc-qcg6-38wj

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:socket:socket.io:*:*:*:*:*:node.js:*:*——socketio
  • cpe:2.3:a:socket:socket.io:*:*:*:*:*:node.js:*:* Versions — — ·socketio

Remediation

  • Fix · CNA socket.io (socketio) Fixed in 2.5.1, 4.6.2
  • Fix · GHSA-25hc-qcg6-38wj socket.io (npm) Fixed in 2.5.1 Advisory →
  • Fix · GHSA-25hc-qcg6-38wj socket.io (npm) Fixed in 4.6.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Will not fix
Red Hat Quay 3AffectedNo fix yet
Not affected: 1 product
  • Logging Subsystem for Red Hat OpenShift

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-38355
  2. 2026-10-03 Alias added: GHSA-25hc-qcg6-38wj

References

Advisory 1

Other 4

  • TI-2022-20281 Uncaught exception in engine.io CVSS 3.1HIGH 7.1
  • TI-2022-02236 Socket.io - Improper type validation in attachment parsing CVSS 3.1CRITICAL 10.0
  • TI-2026-25581 socket.io allows an unbounded number of binary attachments CVSS 4.0HIGH 8.7
  • TI-2022-06052 Uncaught Exception in engine.io CVSS 3.1HIGH 7.5
  • TI-2023-15971 Insufficient validation when decoding a Socket.IO packet CVSS 3.1HIGH 7.5
  • TI-2026-73305 Uncaught exception in Engine.IO lets clients crash Node.js processes CVSS 3.1HIGH 7.5
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences