Skip to content
OpenAdvisories

Package · npm

socket.io

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.3
    CVE-2024-38355 Public exploit

    Unhandled 'error' event in socket.io

    Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af2…

    socketio socket.io socket.io npm
  • Medium 5.3
    CVE-2020-28481

    Insecure Defaults

    The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

    socket.io npm
  • High 7.5
    CVE-2017-16031

    Insecure randomness in socket.io

    Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access …

    HackerOne socket.io node module socket.io npm