CVE-2020-8823: Cross-site scripting in SocksJS-node
Summary
CVE-2020-8823: Cross-site scripting in SocksJS-node. Affects sockjs versions < 0.3.0. Fixed in 0.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SockJS is an open-source JavaScript library that provides a WebSocket-like object in the browser. It allows browsers to communicate with servers using a variety of transport mechanisms, including WebSocket, HTTP streaming, and HTTP long-polling. SockJS-node is the server-side component of SockJS, written in Node.js. It enables server-side implementation of SockJS protocols. The vulnerability identified as CVE-2020-8823 affects SockJS-node versions prior to 0.3.0.
Vulnerability Detail
The vulnerability in SockJS-node is a cross-site scripting (XSS) vulnerability that exists in the 'htmlfile' module of the 'lib/transport/htmlfile.js' file. It is caused by a lack of proper input sanitization in the 'callback' parameter of the '/htmlfile' endpoint. An attacker can exploit this vulnerability by injecting malicious JavaScript code into the 'callback' parameter, which will be executed in the context of the victim's browser when the response is rendered. This can lead to various attacks, such as session hijacking, defacement, or stealing sensitive information.
How To Fix
Latest published version: 0.3.24 as of 23 Oct 2026
npm install sockjs@0.3.24Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.0
This is the first release that contains the fix.
npm install sockjs@0.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually sanitize the 'callback' parameter input before processing it. This can be done by implementing input validation and filtering techniques, such as HTML entity encoding or using a dedicated XSS protection library.
Conclusion
The vulnerability in SockJS-node versions prior to 0.3.0 allows for cross-site scripting (XSS) attacks, which can have serious security implications. It is crucial to upgrade to the latest version or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sockjs →
FAQ
SockJS is a JavaScript library that enables browsers to establish a WebSocket-like connection with servers using various transport mechanisms.
SockJS-node is the server-side component of SockJS, written in Node.js. It allows server-side implementation of SockJS protocols.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The vulnerability can be exploited by attackers to execute arbitrary JavaScript code in the context of a victim's browser, leading to various attacks such as session hijacking, defacement, or data theft.
To mitigate the risk, it is recommended to upgrade to SockJS-node version 0.3.0 or later. If immediate upgrade is not possible, manually sanitize the 'callback' parameter input before processing it.
References
Related vulnerabilities
Recent vulnerabilities recorded for sockjs.
