A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.
TypeError: Cannot convert object to primitive value
at Socket.emit (node:events:507:25)
at .../node_modules/socket.io/lib/socket.js:531:14
There is no known workaround except upgrading to a safe version.
Impact
A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.
Patches
A fix has been released today (2023/05/22):
[email protected][email protected]socket.ioversionsocket.io-parserversion4.5.2...latest~4.2.0(ref)npm audit fixshould be sufficient4.1.3...4.5.1~4.1.1(ref)[email protected]3.0.5...4.1.2~4.0.3(ref)[email protected]3.0.0...3.0.4~4.0.1(ref)[email protected]2.3.0...2.5.0~3.4.0(ref)npm audit fixshould be sufficientWorkarounds
There is no known workaround except upgrading to a safe version.
For more information
If you have any questions or comments about this advisory:
Thanks to @rafax00 for the responsible disclosure.