CVE-2024-38355: Unhandled 'error' event in socket.io (CVSS 7.3)

Description

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit 15af22fc22 which has been included in socket.io@4.6.2 (released in May 2023). The fix was backported in the 2.x branch as well with commit d30630ba10. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.81%Up 0.8 points since Jun 20, 2024

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`socket.io` npm	3.0.0 up to 4.6.2	4.6.2
`socket.io` npm	before 2.5.1	2.5.1
`socket.io` TuxCare:npm From an advisory covering 2 CVEs	2.0.4-tuxcare.0 up to 2.0.4-tuxcare.1, plus listed versions 2.0.4	2.0.4-tuxcare.1
`socket.io` TuxCare:npm	3.1.1-tuxcare.0 up to 3.1.1-tuxcare.1, plus listed versions 3.1.1	3.1.1-tuxcare.1
`socket.io` TuxCare:npm From an advisory covering 2 CVEs	1.7.4-tuxcare.0 up to 1.7.4-tuxcare.1, plus listed versions 1.7.4	1.7.4-tuxcare.1
`socket.io` TuxCare:npm From an advisory covering 2 CVEs	1.7.3-tuxcare.0 up to 1.7.3-tuxcare.1, plus listed versions 1.7.3	1.7.3-tuxcare.1
`socket.io` Root:npm	before 3.1.2-aikido.2	3.1.2-aikido.23.1.2-aikido.32.0.3-aikido.1
`@rootio/socket.io` Root:npm	before 3.1.2-root.io.1	3.1.2-root.io.13.1.2-root.io.23.1.2-root.io.32.0.3-root.io.1
`pgadmin4` SUSE:Linux Enterprise Module for Python 3 15 SP6 From an advisory covering 10 CVEs	before 8.5-150600.3.6.1	8.5-150600.3.6.1
`pgadmin4` openSUSE:Leap 15.6 From an advisory covering 10 CVEs	before 8.5-150600.3.6.1	8.5-150600.3.6.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	PawelMurdzek/CVE-2024-38355-PoC	2025-12-23

What each source reports

CVE List Score used7.3

Unhandled 'error' event in socket.io

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit 15af22fc22 which has been included in socket.io@4.6.2 (released in May 2023). The fix was backported in the 2.x branch as well with commit d30630ba10. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

Record: CVE-2024-38355
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-20, CWE-754
Updated: 2026-11-02

EUVDEUVD-2024-18787.3

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit 15af22fc22 which has been included in socket.io@4.6.2 (released in May 2023). The fix was backported in the 2.x branch as well with commit d30630ba10. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

Record: EUVD-2024-1878
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-25hc-qcg6-38wj6.9

socket.io has an unhandled 'error' event

Impact

A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.

node:events:502
    throw err; // Unhandled 'error' event
    ^

Error [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)
    at new NodeError (node:internal/errors:405:5)
    at Socket.emit (node:events:500:17)
    at /myapp/node_modules/socket.io/lib/socket.js:531:14
    at process.processTicksAndRejections (node:internal/process/task_queues:77:11) {
  code: 'ERR_UNHANDLED_ERROR',
  context: undefined
}

Affected versions

| Version range | Needs minor update? | |------------------|------------------------------------------------| | 4.6.2...latest | Nothing to do | | 3.0.0...4.6.1 | Please upgrade to socket.io@4.6.2 (at least) | | 2.3.0...2.5.0 | Please upgrade to socket.io@2.5.1 |

Patches

This issue is fixed by https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115, included in socket.io@4.6.2 (released in May 2023).

The fix was backported in the 2.x branch today: https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c

Workarounds

As a workaround for the affected versions of the socket.io package, you can attach a listener for the "error" event:

io.on("connection", (socket) => {
  socket.on("error", () => {
    // ...
  });
});

For more information

If you have any questions or comments about this advisory:

Open a discussion here

Thanks a lot to Paul Taylor for the responsible disclosure.

References

Record: GHSA-25hc-qcg6-38wj
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-20, CWE-754
Updated: 2026-11-02

NVD7.3

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit 15af22fc22 which has been included in socket.io@4.6.2 (released in May 2023). The fix was backported in the 2.x branch as well with commit d30630ba10. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

Record: CVE-2024-38355
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-20, CWE-754
Updated: 2026-11-02

OSV7.3

Unhandled 'error' event in socket.io

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit 15af22fc22 which has been included in socket.io@4.6.2 (released in May 2023). The fix was backported in the 2.x branch as well with commit d30630ba10. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

Record: CVE-2024-38355
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-20, CWE-754
Updated: 2026-11-02

OSVGHSA-25hc-qcg6-38wj6.9

socket.io has an unhandled 'error' event

Impact

A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.

node:events:502
    throw err; // Unhandled 'error' event
    ^

Error [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)
    at new NodeError (node:internal/errors:405:5)
    at Socket.emit (node:events:500:17)
    at /myapp/node_modules/socket.io/lib/socket.js:531:14
    at process.processTicksAndRejections (node:internal/process/task_queues:77:11) {
  code: 'ERR_UNHANDLED_ERROR',
  context: undefined
}

Affected versions

| Version range | Needs minor update? | |------------------|------------------------------------------------| | 4.6.2...latest | Nothing to do | | 3.0.0...4.6.1 | Please upgrade to socket.io@4.6.2 (at least) | | 2.3.0...2.5.0 | Please upgrade to socket.io@2.5.1 |

Patches

This issue is fixed by https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115, included in socket.io@4.6.2 (released in May 2023).

The fix was backported in the 2.x branch today: https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c

Workarounds

As a workaround for the affected versions of the socket.io package, you can attach a listener for the "error" event:

io.on("connection", (socket) => {
  socket.on("error", () => {
    // ...
  });
});

For more information

If you have any questions or comments about this advisory:

Open a discussion here

Thanks a lot to Paul Taylor for the responsible disclosure.

References

Record: GHSA-25hc-qcg6-38wj
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-20, CWE-754
Updated: 2026-11-02

Show 6 moreShow less

OSVROOT-APP-NPM-CVE-2024-383557.3

CVE-2024-38355 in socket.io - Patched by Root

Root has patched CVE-2024-38355 in the socket.io package for Root:npm. Multiple fixed versions available.

Record: ROOT-APP-NPM-CVE-2024-38355
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-06

OSVCLSA-2026-1776818218No score

TuxCare security update for socket.io (2 CVEs)

TuxCare rebuilt socket.io to address 2 CVEs. Fixed in 2.0.4-tuxcare.1.

Record: CLSA-2026-1776818218
Updated: 2026-11-02

OSVCLSA-2026-1789549941No score

TuxCare security update for socket.io (1 CVE)

TuxCare rebuilt socket.io to address 1 CVE. Fixed in 3.1.1-tuxcare.1.

Record: CLSA-2026-1789549941
Updated: 2026-11-02

OSVCLSA-2026-1792604680No score

TuxCare security update for socket.io (2 CVEs)

TuxCare rebuilt socket.io to address 2 CVEs. Fixed in 1.7.4-tuxcare.1.

Record: CLSA-2026-1792604680
Updated: 2026-11-02

OSVCLSA-2026-1793304087No score

TuxCare security update for socket.io (2 CVEs)

TuxCare rebuilt socket.io to address 2 CVEs. Fixed in 1.7.3-tuxcare.1.

Record: CLSA-2026-1793304087
Updated: 2026-11-02

OSVSUSE-SU-2024:3771-1No score

Security update for pgadmin4

This update for pgadmin4 fixes the following issues:

CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967)
CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248)
CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252)
CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios (bsc#1229423)
CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS) (bsc#1224366)
CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion (bsc#1224295)
CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS (bsc#1229861)
CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic (bsc#1231684)
CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (bsc#1231564)
CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928)

Record: SUSE-SU-2024:3771-1
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected	OSV
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 23 moreShow less