CVE-2022-2421
CVE-2022-2421 · Socket.io - Improper type validation in attachment parsing
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
CVSS 10.0 · Critical · EPSS 1.6% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
socket.io-parser
- Versions
- ≥ 4.x, < 4.2.1: Affected (custom)
Update to 4.2.1
socket.io-parser npm
- Affected ranges
- SEMVER: ≥ 4.0.0, < 4.0.5
Update to 4.0.5
socket.io-parser npm
- Affected ranges
- SEMVER: ≥ 4.1.0, < 4.2.1
Update to 4.2.1
socket.io-parser npm
- Affected ranges
- SEMVER: < 3.3.3
Update to 3.3.3
socket.io-parser npm
- Affected ranges
- SEMVER: ≥ 3.4.0, < 3.4.2
Update to 3.4.2