search

socketio / socket.io-client

Realtime application framework (client)
https://socket.io
10.62k stars 3.04k forks source link

CVE-2022-2421 Insufficient validation when decoding a Socket.IO packet #1560

Closed 3XC1T3D closed 1 year ago

3XC1T3D commented 1 year ago

CVE-2022-2421 has been reported against socket.io-parser in version 4.2.0, which is currently used by socket.io-client 4.5.3.

Could you possibly update the dependecy to 4.2.1 in socket.io-client 4.5.3?

3XC1T3D commented 1 year ago

I could update the dependecy with following command:

npm update socket.io-parser

darrachequesne commented 1 year ago

@3XC1T3D hi! socket.io-client@4.5.3 uses socket.io-parser@~4.2.0, so running npm audit fix or npm update socket.io-parser should be sufficient.