Socket.IO Memory Exhaustion Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- socket.io (npm)
- Affected versions
- < 2.5.1 or >= 3.0.0, < 4.6.2 or < 2.4.0 or < 0.9.7
- Patched version
- 4.2.7,3.4.5,3.3.6
An early warning has been issued for a memory exhaustion vulnerability in Socket.IO. Users of affected versions should assess their exposure and upgrade to patched versions.
What happened
An early warning has been issued for a vulnerability in Socket.IO that can lead to memory exhaustion. A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, potentially causing the server to run out of memory. This vulnerability affects specific versions of socket.io and socket.io-client.
The affected versions of socket.io are < 2.5.1 or >= 3.0.0, < 4.6.2 or < 2.4.0 or < 0.9.7. The affected versions of socket.io-client are >=4.0.0,<4.2.7. Patched versions are available for both components.
What to do about it
- Upgrade socket.io to version 4.2.7, 3.4.5, or 3.3.6.
- Upgrade socket.io-client to version 4.2.7.
- Monitor the primary sources for updates on this vulnerability.
How 0Day would have caught this
socket.io is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using socket.io versions < 2.5.1 or >= 3.0.0, < 4.6.2 or < 2.4.0 or < 0.9.7, or socket.io-client versions >=4.0.0,<4.2.7.
What should I do right now?
Upgrade to the fixed versions of socket.io (4.2.7, 3.4.5, or 3.3.6) and socket.io-client (4.2.7).
Where can I find more information?
Consult the primary sources for more information: [GHSA-2m8v-j782-fhvr] Socket.IO: Zero-attachment Memory Exhaustion (https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr).