Description
Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtaining sensitive information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HackerOne | socket.io node module | <=0.9.6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | socket.io | < 0.9.7 | 0.9.7 | GHSA-qv2v-m59f-v5fw |