Executive brief
Socket.IO is a popular framework used for real-time, bidirectional communication between web clients and servers. A vulnerability in how the server handles specific network packets allows an attacker to crash the application. This results in a denial-of-service (DoS) condition, potentially disrupting real-time services and impacting business operations.
Technical details
The vulnerability exists because the Socket.IO server does not always have a default listener for 'error' events emitted by individual sockets. In Node.js, emitting an 'error' event on an EventEmitter without at least one registered listener causes the process to throw an uncaught exception and exit. An attacker can send a specially crafted packet that triggers such an error (e.g., via invalid packet structures or middleware rejections), leading to a process crash. The fix involves adding a no-op ('noop') error listener by default to prevent these uncaught exceptions. Patches are available in versions 2.5.1 and 4.6.2.
Affected products
- Socket.IO socket.io < 2.5.1, >= 3.0.0, < 4.6.2
Timeline
- 2023-05-01: patched: Initial fix released in version 4.6.2
- 2024-06-19: advisory: GHSA-25hc-qcg6-38wj published and fix backported to 2.x branch