Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2024-06-19T19:48:50.193Z
Updated: 2024-06-19T19:48:50.193Z
Reserved: 2024-06-14T14:16:16.464Z
Link: CVE-2024-38355
JSON object: View
NVD Information
Status : Awaiting Analysis
Published: 2024-06-19T20:15:11.180
Modified: 2024-06-20T12:43:25.663
Link: CVE-2024-38355
JSON object: View
Redhat Information
No data.