@socket.io Socket.io-Parser vulnerabilities

Latest @socket.io Socket.io-Parser CVEs

Newest publication first

1. CVE-2022-2421 Socket.io - Improper type validation in attachment parsing

   Published 2022-10-25

   Critical·CVSS 9.8

   Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.