GCVE - cpe:2.3:a:socket:socket.io:*:*:*:*:*:node.js:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:socket:socket.io:*:*:*:*:*:node.js:*:*

part: a version: * update: *

Vendor	Socket (`53b1d7d6-51ad-597f-9f95-5bf97e6c98c9`)
Product	Socket.Io (`56f78f24-5048-5254-b6ea-4be20ecca825`)
Edition	*
Language	*
Software edition	*
Target software	node.js
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/socketio/socket.io`	purl2cpe	2026-06-01 10:11:10.162775
`pkg:maven/org.webjars.npm/socket.io`	purl2cpe	2026-06-01 10:11:10.162777
`pkg:npm/socket.io`	purl2cpe	2026-06-01 10:11:10.162778
`pkg:rpm/opensuse/nodejs-socket.io`	purl2cpe	2026-06-01 10:11:10.162779
`pkg:sourceforge/socket-io.mirror`	purl2cpe	2026-06-01 10:11:10.162781

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-38355`	vulnerable	2026-06-08 06:41:45.119838	Unhandled 'error' event in socket.io HIGH (7.3) Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors. Published: 2024-06-19T19:48:50.193Z Updated: 2024-09-03T20:35:40.515Z Open on db.gcve.eu Reference links https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115 https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-28481`	vulnerable	2026-06-08 05:23:56.150435	Insecure Defaults MEDIUM (5.3) The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default. Published: 2021-01-19T14:45:17.064Z Updated: 2024-09-16T20:11:33.987Z Open on db.gcve.eu Reference links https://snyk.io/vuln/SNYK-JS-SOCKETIO-1024859 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1056357 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1056358 https://github.com/socketio/socket.io/issues/3671	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-16031`	vulnerable	2026-06-08 05:08:59.899962	Details available Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtaining sensitive information. Published: 2018-06-04T19:00:00.000Z Updated: 2024-09-16T21:07:25.207Z Open on db.gcve.eu Reference links https://github.com/socketio/socket.io/commit/67b4eb9abdf111dfa9be4176d1709374a2b4ded8 https://github.com/socketio/socket.io/issues/856 https://github.com/socketio/socket.io/pull/857 https://nodesecurity.io/advisories/321	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.