Threats affecting pkg:npm/socket.io/socket.io

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.

Socket.IO versions prior to 3.3.5, 3.4.4, and 4.2.6 contain an improper input validation vulnerability. A specially crafted packet can cause the server to buffer a large number of binary attachments, potentially exhausting server memory. This vulnerability has been patched in the specified versions.