Executive brief
socket.io-parser is a Node.js library used to serialize and deserialize Socket.IO protocol messages. An attacker can send specially crafted large packets to cause the server to consume excessive memory and crash (denial of service), affecting any application using vulnerable versions of this library.
Technical details
The vulnerability is a resource exhaustion (CWE-400) caused by inefficient string concatenation during packet parsing. When processing large packets, the decoder builds very long strings by repeatedly concatenating smaller strings, creating many intermediate ConsOneByteString objects that consume heap memory. An unauthenticated, network-accessible attacker can send a crafted packet exceeding maxHttpBufferSize (e.g., 100 MB) to trigger out-of-memory conditions and crash the Node.js process. The fix, released in versions 3.3.2 and 3.4.1, replaces concatenation with substring-based string extraction to avoid the intermediate object creation.
Affected products
- socket.io socket.io-parser before 3.3.2 and 3.4.0 before 3.4.1
Timeline
- 2021-01-08: disclosed: CVE-2020-36049 published on NVD
- 2021-04-06: patched: GitHub security advisory published and reviewed
- 2021-06-30: patched: GHSA-xfhh-g9f5-x4m4 published; fixes available in 3.3.2 and 3.4.1