Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: socketio Component: Socket.io-parser Clear all filters
TI-2026-25581 CVE-2026-33151 · GHSA-677m-j7p3-52f9

socket.io allows an unbounded number of binary attachments

Priority MEDIUM 44

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00535 Published 2026-03-20 Partial fix · 3.3.5, 3.4.4 +1 CWE-20
TI-2023-15971 CVE-2023-32695 · GHSA-cqmj-92xf-r6r9

Insufficient validation when decoding a Socket.IO packet

Priority MEDIUM 41

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01059 Published 2023-05-27 Fixed in 4.2.3, 3.4.3 +1 CWE-20
TI-2022-02236 CVE-2022-2421 · GHSA-qm95-pgcg-qqfq

Socket.io - Improper type validation in attachment parsing

Priority MEDIUM 52

Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the res…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01431 Published 2022-10-25 Fixed in 4.2.1, 4.0.5 +2 CWE-89