Description
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| socketio | socket.io | < 2.5.1, >= 3.0.0,< 4.6.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 3 | pgadmin4 | 8.5-150600.3.6.1 | SUSE-SU-2024:3771-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | pgadmin4 | 8.5-150600.3.6.1 | SUSE-SU-2024:3771-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
PawelMurdzek/CVE-2024-38355-PoC ★ 0 · Dec 23, 2025
Proof of concept of CVE-2024-47554
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | socket.io | < 2.5.1 | 2.5.1 | GHSA-25hc-qcg6-38wj |
| npm | socket.io | >= 3.0.0, < 4.6.2 | 4.6.2 | GHSA-25hc-qcg6-38wj |
Advisories 5
- SUSE-SU-2024:3771-1 Security update for pgadmin4 SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-24-256-08 Siemens Industrial Products CISA ICS & IT advisories · May 6, 2025
- WID-SEC-2024-2091 Siemens SIMATIC WinCC: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Feb 5, 2025
- SSA-773256 SSA-773256: Impact of Socket.IO CVE-2024-38355 on Siemens Industrial Products Siemens ProductCERT · Jan 14, 2025
- NCSC-2024-0362 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Sep 10, 2024