Impact

A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.

TypeError: Cannot convert object to primitive value
       at Socket.emit (node:events:507:25)
       at .../node_modules/socket.io/lib/socket.js:531:14

Patches

A fix has been released today (2023/05/22):

• socketio/socket.io-parser@3b78117, included in socket.io-parser@4.2.3
• socketio/socket.io-parser@2dc3c92, included in socket.io-parser@3.4.3

Another fix has been released for the 3.3.x branch:

• socketio/socket.io-parser@ee00660, included in `socket.io-parser@3.3.4

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

• Open a discussion here

Thanks to @rafax00 for the responsible disclosure.

References

• GHSA-cqmj-92xf-r6r9
• socketio/socket.io-parser@2dc3c92
• socketio/socket.io-parser@3b78117
• socketio/socket.io-parser@1c220dd
• https://nvd.nist.gov/vuln/detail/CVE-2023-32695
• https://github.com/socketio/socket.io-parser/releases/tag/4.2.3
• socketio/socket.io-parser@ee00660