GCVE - cpe:2.3:a:socket:socket.io-parser:*:*:*:*:*:node.js:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:socket:socket.io-parser:*:*:*:*:*:node.js:*:*

part: a version: * update: *

Vendor	Socket (`53b1d7d6-51ad-597f-9f95-5bf97e6c98c9`)
Product	Socket.Io Parser (`2c44c9b3-343d-53b5-884f-2531473676f0`)
Edition	*
Language	*
Software edition	*
Target software	node.js
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-33151`	vulnerable	2026-06-08 07:59:09.177195	socket.io allows an unbounded number of binary attachments Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6. Published: 2026-03-20T20:13:31.424Z Updated: 2026-03-23T16:50:16.998Z Open on db.gcve.eu Reference links https://github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9 https://github.com/socketio/socket.io/commit/719f9ebab0772ffb882bd614b387e585c1aa75d4 https://github.com/socketio/socket.io/commit/9d39f1f080510f036782f2177fac701cc041faaf https://github.com/socketio/socket.io/commit/b25738c416c4e32fbff62ee182afa8f6d0dacf78	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-32695`	vulnerable	2026-06-08 06:04:47.049802	Insufficient validation when decoding a Socket.IO packet HIGH (7.3) socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3. Published: 2023-05-27T15:44:03.235Z Updated: 2025-01-13T21:03:34.130Z Open on db.gcve.eu Reference links https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9 https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3 https://github.com/socketio/socket.io-parser/releases/tag/4.2.3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-2421`	vulnerable	2026-06-08 05:43:35.514691	Socket.io - Improper type validation in attachment parsing CRITICAL (10) Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object. Published: 2022-10-25T00:00:00.000Z Updated: 2025-03-11T13:40:55.218Z Open on db.gcve.eu Reference links https://csirt.divd.nl/CVE-2022-2421 https://csirt.divd.nl/DIVD-2022-00045	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-36049`	vulnerable	2026-06-08 05:25:02.430870	Details available socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used. Published: 2021-01-07T23:24:23.000Z Updated: 2024-08-04T17:16:14.004Z Open on db.gcve.eu Reference links https://blog.caller.xyz/socketio-engineio-dos/ https://github.com/bcaller/kill-engine-io https://github.com/socketio/socket.io-parser/commit/dcb942d24db97162ad16a67c2a0cf30875342d55	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.