CVE-2023-32695: Insufficient validation when decoding a Socket.IO packet in socket.io-parser
Summary
CVE-2023-32695: Insufficient validation when decoding a Socket.IO packet. Affects socket.io-parser across 3 version ranges.
< 3.3.4
>= 3.4.0, < 3.4.3
>= 4.0.4, < 4.2.3
Fixed in 3.3.4, 3.4.3 or 4.2.3, depending on the release line you run. How to fix ↓
Also tracked for
- node-socket.io-parser · Debian:12
The same CVE-2023-32695 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Socket.IO is a JavaScript library for real-time web applications. It enables bidirectional communication between web clients and servers. The socket.io-parser package is responsible for parsing and encoding Socket.IO packets. This vulnerability affects versions 2.3.0 to 4.5.2 of the socket.io package. The vulnerability allows a specially crafted Socket.IO packet to trigger an uncaught exception on the Socket.IO server, leading to the termination of the Node.js process.
Vulnerability Detail
The vulnerability arises due to insufficient validation when decoding a Socket.IO packet. An attacker can exploit this by sending a specially crafted packet to the server. When the server attempts to decode the packet, it encounters an uncaught exception, resulting in a Node.js process crash. The exception message typically states 'TypeError: Cannot convert object to primitive value'. This vulnerability has a CVSS score of 7.3, indicating a high severity level.
How To Fix
Latest published version: 4.2.7 as of 23 Oct 2026
npm install socket.io-parser@4.2.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.3.43.3.4npm install socket.io-parser@3.3.4 -
>= 3.4.0, < 3.4.33.4.3npm install socket.io-parser@3.4.3 -
>= 4.0.4, < 4.2.34.2.3npm install socket.io-parser@4.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability other than upgrading to a safe version.
Conclusion
In conclusion, the socket.io-parser package in Socket.IO is vulnerable to a denial of service attack due to insufficient validation when decoding packets. To mitigate this vulnerability, it is crucial to upgrade to a safe version of the socket.io package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for socket.io-parser →
FAQ
Socket.IO is a JavaScript library that enables real-time, bidirectional communication between web clients and servers.
socket.io-parser is a package used by Socket.IO for parsing and encoding Socket.IO packets.
A specially crafted Socket.IO packet can crash the Node.js process on the server, leading to a denial of service.
You can fix this vulnerability by upgrading to a safe version of the socket.io package.
No, there is no known workaround other than upgrading to a safe version.
References
Related vulnerabilities
Recent vulnerabilities recorded for socket.io-parser.
