{"id":"CVE-2022-2421","aliases":["CLSA-2026-1772496675","CLSA-2026-1776731787","CLSA-2026-1791899634","CLSA-2026-1792599106","CLSA-2026-1792665531","EUVD-2022-7153","GHSA-qm95-pgcg-qqfq"],"status":"published","title":"Socket.io - Improper type validation in attachment parsing","description":"Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01441,"percentile":0.73545,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1287","CWE-20","CWE-89"],"published":"2022-10-25T00:00:00Z","modified":"2026-10-28T02:30:38Z","fixes":[{"ecosystem":"npm","package":"socket.io-parser","fixed_in":["4.2.1","4.0.5","3.3.3","3.4.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.2.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.1"}]}],"versions":["3.2.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.3-tuxcare.0"},{"fixed":"3.1.3-tuxcare.1"}]}],"versions":["3.1.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.1-tuxcare.0"},{"fixed":"2.3.1-tuxcare.1"}]}],"versions":["2.3.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.2-tuxcare.0"},{"fixed":"2.2.2-tuxcare.1"}]}],"versions":["2.2.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.4-tuxcare.0"},{"fixed":"2.2.4-tuxcare.1"}]}],"versions":["2.2.4"],"bundled":5},{"source":"osv","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.0.5"}]}]},{"source":"osv","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"4.1.0"},{"fixed":"4.2.1"}]}]},{"source":"osv","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.3"}]}]},{"source":"osv","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"3.4.0"},{"fixed":"3.4.2"}]}]}],"products":[{"vendor":"socket","product":"socket.io-parser"},{"vendor":"socket.io","product":"socket.io-parser"},{"vendor":"socketio","product":"socket.io-parser"}],"references":[{"url":"https://csirt.divd.nl/CVE-2022-2421","tags":["third-party-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://csirt.divd.nl/DIVD-2022-00045","tags":["third-party-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2421","tags":["advisory"]},{"url":"https://csirt.divd.nl/cases/DIVD-2022-00045","tags":["web"]},{"url":"https://csirt.divd.nl/cves/CVE-2022-2421","tags":["web"]},{"url":"https://github.com/socketio/socket.io-parser/commit/b559f050ee02bd90bd853b9823f8de7fa94a80d4","tags":["web"]},{"url":"https://github.com/socketio/socket.io-parser/commit/b5d0cb7dc56a0601a09b056beaeeb0e43b160050","tags":["web"]},{"url":"https://github.com/socketio/socket.io-parser/commit/04d23cecafe1b859fb03e0cbf6ba3b74dff56d14","tags":["web"]},{"url":"https://github.com/socketio/socket.io-parser/commit/fb21e422fc193b34347395a33e0f625bebc09983","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qm95-pgcg-qqfq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2421.json","tags":["advisory"]},{"url":"https://github.com/socketio/socket.io-parser","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-2421","title":"Socket.io - Improper type validation in attachment parsing","description":"Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.","status":"published","published":"2022-10-25T00:00:00Z","modified":"2025-03-11T13:40:55.218Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:32.156873Z"}],"euvd":[{"id":"EUVD-2022-7153","description":"Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.","status":"published","published":"2022-10-25T00:00:00Z","modified":"2025-03-11T13:40:55Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:53:07.779422Z"}],"ghsa":[{"id":"GHSA-qm95-pgcg-qqfq","title":"Insufficient validation when decoding a Socket.IO packet","description":"Due to improper type validation in the `socket.io-parser` library (which is used by the `socket.io` and `socket.io-client` packages to encode and decode Socket.IO packets), it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.\n\nExample:\n\n```js\nconst decoder = new Decoder();\n\ndecoder.on(\"decoded\", (packet) =\u003e {\n console.log(packet.data); // prints [ 'hello', [Function: splice] ]\n})\n\ndecoder.add('51-[\"hello\",{\"_placeholder\":true,\"num\":\"splice\"}]');\ndecoder.add(Buffer.from(\"world\"));\n```\n\nThis bubbles up in the `socket.io` package:\n\n```js\nio.on(\"connection\", (socket) =\u003e {\n socket.on(\"hello\", (val) =\u003e {\n // here, \"val\" could be a function instead of a buffer\n });\n});\n```\n\n:warning: IMPORTANT NOTE :warning:\n\nYou need to make sure that the payload that you received from the client is actually a `Buffer` object:\n\n```js\nio.on(\"connection\", (socket) =\u003e {\n socket.on(\"hello\", (val) =\u003e {\n if (!Buffer.isBuffer(val)) {\n socket.disconnect();\n return;\n }\n // ...\n });\n});\n```\n\n**If that's already the case, then you are not impacted by this issue, and there is no way an attacker could make your server crash (or escalate privileges, ...).**\n\nExample of values that could be sent by a malicious user:\n\n- a number that is out of bounds\n\nSample packet: `451-[\"hello\",{\"_placeholder\":true,\"num\":10}]`\n\n```js\nio.on(\"connection\", (socket) =\u003e {\n socket.on(\"hello\", (val) =\u003e {\n // val is `undefined`\n });\n});\n```\n\n- a value that is not a number, like `undefined`\n\nSample packet: `451-[\"hello\",{\"_placeholder\":true,\"num\":undefined}]`\n\n```js\nio.on(\"connection\", (socket) =\u003e {\n socket.on(\"hello\", (val) =\u003e {\n // val is `undefined`\n });\n});\n```\n\n- a string that is part of the prototype of `Array`, like \"push\"\n\nSample packet: `451-[\"hello\",{\"_placeholder\":true,\"num\":\"push\"}]`\n\n```js\nio.on(\"connection\", (socket) =\u003e {\n socket.on(\"hello\", (val) =\u003e {\n // val is a reference to the \"push\" function\n });\n});\n```\n\n- a string that is part of the prototype of `Object`, like \"hasOwnProperty\"\n\nSample packet: `451-[\"hello\",{\"_placeholder\":true,\"num\":\"hasOwnProperty\"}]`\n\n```js\nio.on(\"connection\", (socket) =\u003e {\n socket.on(\"hello\", (val) =\u003e {\n // val is a reference to the \"hasOwnProperty\" function\n });\n});\n```\n\nThis should be fixed by:\n\n- https://github.com/socketio/socket.io-parser/commit/b5d0cb7dc56a0601a09b056beaeeb0e43b160050, included in `socket.io-parser@4.2.1`\n- https://github.com/socketio/socket.io-parser/commit/b559f050ee02bd90bd853b9823f8de7fa94a80d4, included in `socket.io-parser@4.0.5`\n- https://github.com/socketio/socket.io-parser/commit/04d23cecafe1b859fb03e0cbf6ba3b74dff56d14, included in `socket.io-parser@3.4.2`\n- https://github.com/socketio/socket.io-parser/commit/fb21e422fc193b34347395a33e0f625bebc09983, included in `socket.io-parser@3.3.3`\n\n### Dependency analysis for the `socket.io` package\n\n| `socket.io` version | `socket.io-parser` version | Covered? |\n|---------------------|---------------------------------------------------------------------------------------------------------|------------------------|\n| `4.5.2...latest` | `~4.2.0` ([ref](https://github.com/socketio/socket.io/commit/9890b036cf942f6b6ad2afeb6a8361c32cd5d528)) | Yes :heavy_check_mark: |\n| `4.1.3...4.5.1` | `~4.0.4` ([ref](https://github.com/socketio/socket.io/commit/7c44893d7878cd5bba1eff43150c3e664f88fb57)) | Yes :heavy_check_mark: |\n| `3.0.5...4.1.2` | `~4.0.3` ([ref](https://github.com/socketio/socket.io/commit/752dfe3b1e5fecda53dae899b4a39e6fed5a1a17)) | Yes :heavy_check_mark: |\n| `3.0.0...3.0.4` | `~4.0.1` ([ref](https://github.com/socketio/socket.io/commit/1af3267e3f5f7884214cf2ca4d5282d620092fb0)) | Yes :heavy_check_mark: |\n| `2.3.0...2.5.0` | `~3.4.0` ([ref](https://github.com/socketio/socket.io/commit/cf39362014f5ff13a17168b74772c43920d6e4fd)) | Yes :heavy_check_mark: |\n\n\n### Dependency analysis for the `socket.io-client` package\n\n| `socket.io-client` version | `socket.io-parser` version | Covered? |\n|----------------------------|----------------------------------------------------------------------------------------------------------------|------------------------------------|\n| `4.5.0...latest` | `~4.2.0` ([ref](https://github.com/socketio/socket.io-client/commit/b862924b7f1720979e5db2f0154906b305d420e3)) | Yes :heavy_check_mark: |\n| `4.3.0...4.4.1` | `~4.1.1` ([ref](https://github.com/socketio/socket.io-client/commit/91b948b8607166fcc79f028a6428819277214188)) | No, but the impact is very limited |\n| `3.1.0...4.2.0` | `~4.0.4` ([ref](https://github.com/socketio/socket.io-client/commit/5d9b4eb42b1f5778e6f033096694acb331b132c4)) | Yes :heavy_check_mark: |\n| `3.0.5` | `~4.0.3` ([ref](https://github.com/socketio/socket.io-client/commit/cf9fc358365cc15a41260a51dc186c881bf086ca)) | Yes :heavy_check_mark: |\n| `3.0.0...3.0.4` | `~4.0.1` ([ref](https://github.com/socketio/socket.io-client/commit/b7e07ba633ceb9c1dc94cc894c10b9bfca536c7a)) | Yes :heavy_check_mark: |\n| `2.2.0...2.5.0` | `~3.3.0` ([ref](https://github.com/socketio/socket.io-client/commit/06e9a4ca2621176c30c352b2ba8b34fa42b8d0ba)) | Yes :heavy_check_mark: |\n","status":"published","published":"2022-10-26T12:00:28Z","modified":"2024-04-22T19:11:12Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-89","CWE-1287"],"updated_at":"2026-11-02T14:37:44.335614Z"}],"nvd":[{"id":"CVE-2022-2421","description":"Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.","status":"published","published":"2022-10-26T10:15:16.78Z","modified":"2026-06-17T04:41:51.947Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:07:31.127985Z"}],"osv":[{"id":"CVE-2022-2421","title":"Socket.io - Improper type validation in attachment parsing","description":"Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.","status":"published","published":"2022-10-25T00:00:00Z","modified":"2026-10-28T02:30:38.132261199Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"GHSA-qm95-pgcg-qqfq","title":"Insufficient validation when decoding a Socket.IO packet","description":"Due to improper type validation in the `socket.io-parser` library (which is used by the `socket.io` and `socket.io-client` packages to encode and decode Socket.IO packets), it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.\n\nExample:\n\n```js\nconst decoder = new Decoder();\n\ndecoder.on(\"decoded\", (packet) =\u003e {\n console.log(packet.data); // prints [ 'hello', [Function: splice] ]\n})\n\ndecoder.add('51-[\"hello\",{\"_placeholder\":true,\"num\":\"splice\"}]');\ndecoder.add(Buffer.from(\"world\"));\n```\n\nThis bubbles up in the `socket.io` package:\n\n```js\nio.on(\"connection\", (socket) =\u003e {\n socket.on(\"hello\", (val) =\u003e {\n // here, \"val\" could be a function instead of a buffer\n });\n});\n```\n\n:warning: IMPORTANT NOTE :warning:\n\nYou need to make sure that the payload that you received from the client is actually a `Buffer` object:\n\n```js\nio.on(\"connection\", (socket) =\u003e {\n socket.on(\"hello\", (val) =\u003e {\n if (!Buffer.isBuffer(val)) {\n socket.disconnect();\n return;\n }\n // ...\n });\n});\n```\n\n**If that's already the case, then you are not impacted by this issue, and there is no way an attacker could make your server crash (or escalate privileges, ...).**\n\nExample of values that could be sent by a malicious user:\n\n- a number that is out of bounds\n\nSample packet: `451-[\"hello\",{\"_placeholder\":true,\"num\":10}]`\n\n```js\nio.on(\"connection\", (socket) =\u003e {\n socket.on(\"hello\", (val) =\u003e {\n // val is `undefined`\n });\n});\n```\n\n- a value that is not a number, like `undefined`\n\nSample packet: `451-[\"hello\",{\"_placeholder\":true,\"num\":undefined}]`\n\n```js\nio.on(\"connection\", (socket) =\u003e {\n socket.on(\"hello\", (val) =\u003e {\n // val is `undefined`\n });\n});\n```\n\n- a string that is part of the prototype of `Array`, like \"push\"\n\nSample packet: `451-[\"hello\",{\"_placeholder\":true,\"num\":\"push\"}]`\n\n```js\nio.on(\"connection\", (socket) =\u003e {\n socket.on(\"hello\", (val) =\u003e {\n // val is a reference to the \"push\" function\n });\n});\n```\n\n- a string that is part of the prototype of `Object`, like \"hasOwnProperty\"\n\nSample packet: `451-[\"hello\",{\"_placeholder\":true,\"num\":\"hasOwnProperty\"}]`\n\n```js\nio.on(\"connection\", (socket) =\u003e {\n socket.on(\"hello\", (val) =\u003e {\n // val is a reference to the \"hasOwnProperty\" function\n });\n});\n```\n\nThis should be fixed by:\n\n- https://github.com/socketio/socket.io-parser/commit/b5d0cb7dc56a0601a09b056beaeeb0e43b160050, included in `socket.io-parser@4.2.1`\n- https://github.com/socketio/socket.io-parser/commit/b559f050ee02bd90bd853b9823f8de7fa94a80d4, included in `socket.io-parser@4.0.5`\n- https://github.com/socketio/socket.io-parser/commit/04d23cecafe1b859fb03e0cbf6ba3b74dff56d14, included in `socket.io-parser@3.4.2`\n- https://github.com/socketio/socket.io-parser/commit/fb21e422fc193b34347395a33e0f625bebc09983, included in `socket.io-parser@3.3.3`\n\n### Dependency analysis for the `socket.io` package\n\n| `socket.io` version | `socket.io-parser` version | Covered? |\n|---------------------|---------------------------------------------------------------------------------------------------------|------------------------|\n| `4.5.2...latest` | `~4.2.0` ([ref](https://github.com/socketio/socket.io/commit/9890b036cf942f6b6ad2afeb6a8361c32cd5d528)) | Yes :heavy_check_mark: |\n| `4.1.3...4.5.1` | `~4.0.4` ([ref](https://github.com/socketio/socket.io/commit/7c44893d7878cd5bba1eff43150c3e664f88fb57)) | Yes :heavy_check_mark: |\n| `3.0.5...4.1.2` | `~4.0.3` ([ref](https://github.com/socketio/socket.io/commit/752dfe3b1e5fecda53dae899b4a39e6fed5a1a17)) | Yes :heavy_check_mark: |\n| `3.0.0...3.0.4` | `~4.0.1` ([ref](https://github.com/socketio/socket.io/commit/1af3267e3f5f7884214cf2ca4d5282d620092fb0)) | Yes :heavy_check_mark: |\n| `2.3.0...2.5.0` | `~3.4.0` ([ref](https://github.com/socketio/socket.io/commit/cf39362014f5ff13a17168b74772c43920d6e4fd)) | Yes :heavy_check_mark: |\n\n\n### Dependency analysis for the `socket.io-client` package\n\n| `socket.io-client` version | `socket.io-parser` version | Covered? |\n|----------------------------|----------------------------------------------------------------------------------------------------------------|------------------------------------|\n| `4.5.0...latest` | `~4.2.0` ([ref](https://github.com/socketio/socket.io-client/commit/b862924b7f1720979e5db2f0154906b305d420e3)) | Yes :heavy_check_mark: |\n| `4.3.0...4.4.1` | `~4.1.1` ([ref](https://github.com/socketio/socket.io-client/commit/91b948b8607166fcc79f028a6428819277214188)) | No, but the impact is very limited |\n| `3.1.0...4.2.0` | `~4.0.4` ([ref](https://github.com/socketio/socket.io-client/commit/5d9b4eb42b1f5778e6f033096694acb331b132c4)) | Yes :heavy_check_mark: |\n| `3.0.5` | `~4.0.3` ([ref](https://github.com/socketio/socket.io-client/commit/cf9fc358365cc15a41260a51dc186c881bf086ca)) | Yes :heavy_check_mark: |\n| `3.0.0...3.0.4` | `~4.0.1` ([ref](https://github.com/socketio/socket.io-client/commit/b7e07ba633ceb9c1dc94cc894c10b9bfca536c7a)) | Yes :heavy_check_mark: |\n| `2.2.0...2.5.0` | `~3.3.0` ([ref](https://github.com/socketio/socket.io-client/commit/06e9a4ca2621176c30c352b2ba8b34fa42b8d0ba)) | Yes :heavy_check_mark: |\n","status":"published","published":"2022-10-26T12:00:28Z","modified":"2023-11-08T04:08:29.946069Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1287","CWE-20","CWE-89"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"CLSA-2026-1772496675","title":"TuxCare security update for socket.io-parser (3 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 3 CVEs. Fixed in 3.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:08Z","modified":"2026-10-15T09:47:46.249288204Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1776731787","title":"TuxCare security update for socket.io-parser (3 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 3 CVEs. Fixed in 3.1.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-25T01:43:09.398850678Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1791899634","title":"TuxCare security update for socket.io-parser (5 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 5 CVEs. Fixed in 2.3.1-tuxcare.1.","status":"published","published":"2026-10-13T13:53:54Z","modified":"2026-10-15T09:47:53.469310802Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792599106","title":"TuxCare security update for socket.io-parser (5 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 5 CVEs. Fixed in 2.2.2-tuxcare.1.","status":"published","published":"2026-10-21T16:11:46Z","modified":"2026-10-21T20:30:50.501354765Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792665531","title":"TuxCare security update for socket.io-parser (5 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 5 CVEs. Fixed in 2.2.4-tuxcare.1.","status":"published","published":"2026-10-22T10:38:51Z","modified":"2026-10-22T14:15:04.657404145Z","updated_at":"2026-11-02T15:43:54.981307Z"}]}}