Medium

Insufficient validation when decoding a Socket.IO packet

Disclosed: 23.05.2023
Updated: 11.10.2026 10:22

Impact

A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.

TypeError: Cannot convert object to primitive value
       at Socket.emit (node:events:507:25)
       at .../node_modules/socket.io/lib/socket.js:531:14

Patches

A fix has been released today (2023/05/22):

https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3, included in socket.io-parser@4.2.3
https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced, included in socket.io-parser@3.4.3

Another fix has been released for the 3.3.x branch:

https://github.com/socketio/socket.io-parser/commit/ee006607495eca4ec7262ad080dd3a91439a5ba4, included in `socket.io-parser@3.3.4

`socket.io` version	`socket.io-parser` version	Needs minor update?
`4.5.2...latest`	`~4.2.0` (ref)	`npm audit fix` should be sufficient
`4.1.3...4.5.1`	`~4.1.1` (ref)	Please upgrade to `socket.io@4.6.x`
`3.0.5...4.1.2`	`~4.0.3` (ref)	Please upgrade to `socket.io@4.6.x`
`3.0.0...3.0.4`	`~4.0.1` (ref)	Please upgrade to `socket.io@4.6.x`
`2.3.0...2.5.0`	`~3.4.0` (ref)	`npm audit fix` should be sufficient

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

Open a discussion here

Thanks to @rafax00 for the responsible disclosure.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	socket.io-parser	>= 4.0.4, < 4.2.3, >= 3.4.0, < 3.4.3, < 3.3.4	4.2.3, 3.4.3, 3.3.4

References

CVSS score 7.3/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness (CWE): CWE-20, CWE-754
Platform: npm
Package: socket.io-parser
Disclosed: 23.05.2023
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-cqmj-92xf-r6r9 - CC BY 4.0

Vulnerability history: socket.io-parser

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 5
First → latest: 06.2021 08.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 1
High 3
Medium 1

Disclosures per year

2021: 1
2022: 1
2023: 1
2024: 0
2025: 0
2026: 2

03.08.2026

Socket.IO: Zero-attachment Memory Exhaustion

High · 7.5 CVE-2026-69185 >= 4.0.0, < 4.2.7, >= 3.4.0, < 3.4.5, < 3.3.6 4.2.7, 3.4.5, 3.3.6
18.03.2026

socket.io allows an unbounded number of binary attachments

High CVE-2026-33151 < 3.3.5, >= 3.4.0, < 3.4.4, >= 4.0.0, < 4.2.6 3.3.5, 3.4.4, 4.2.6
23.05.2023

Insufficient validation when decoding a Socket.IO packet this entry

Medium · 7.3 CVE-2023-32695 >= 4.0.4, < 4.2.3, >= 3.4.0, < 3.4.3, < 3.3.4 4.2.3, 3.4.3, 3.3.4
26.10.2022

Insufficient validation when decoding a Socket.IO packet

Critical · 9.8 CVE-2022-2421 >= 4.0.0, < 4.0.5, >= 4.1.0, < 4.2.1, < 3.3.3, >= 3.4.0, < 3.4.2 4.0.5, 4.2.1, 3.3.3, 3.4.2
30.06.2021

Resource exhaustion in socket.io-parser

High · 7.5 CVE-2020-36049 < 3.3.2, >= 3.4.0, < 3.4.1 3.3.2, 3.4.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application