{"id":"CVE-2023-32695","aliases":["CLSA-2026-1772496675","CLSA-2026-1791899634","CLSA-2026-1792599106","CLSA-2026-1792665531","DEBIAN-CVE-2023-32695","EUVD-2023-1528","GHSA-cqmj-92xf-r6r9","ROOT-APP-NPM-CVE-2023-32695","UBUNTU-CVE-2023-32695"],"status":"published","title":"Insufficient validation when decoding a Socket.IO packet","description":"socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01059,"percentile":0.64772,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-754"],"published":"2023-05-23T19:55:13Z","modified":"2026-10-28T02:30:47Z","fixes":[{"ecosystem":"npm","package":"socket.io-parser","fixed_in":["3.4.3","4.2.3","3.3.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"node-socket.io-parser","fixed_in":["4.2.1+~3.1.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-socket.io-parser","fixed_in":["4.2.1+~3.1.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-socket.io-parser","fixed_in":["4.2.1+~3.1.0-2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/socket.io-parser","fixed_in":["4.0.5-root.io.1","4.0.5-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"socket.io-parser","fixed_in":["4.0.5-aikido.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.4"},{"fixed":"4.2.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.1"}]}],"versions":["3.2.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.1-tuxcare.0"},{"fixed":"2.3.1-tuxcare.1"}]}],"versions":["2.3.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.2-tuxcare.0"},{"fixed":"2.2.2-tuxcare.1"}]}],"versions":["2.2.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.4-tuxcare.0"},{"fixed":"2.2.4-tuxcare.1"}]}],"versions":["2.2.4"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1+~3.1.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1+~3.1.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1+~3.1.0-2"}]}]},{"source":"osv","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.4"},{"fixed":"4.2.3"}]}]},{"source":"osv","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"3.4.0"},{"fixed":"3.4.3"}]}]},{"source":"osv","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.5-root.io.1"},{"fixed":"4.0.5-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.5-aikido.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.0-1","3.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.2-1","4.1.1+~3.0.0-1","4.1.2+~3.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1+~3.1.0-3"]}],"products":[{"vendor":"socket","product":"socket.io-parser"},{"vendor":"socketio","product":"socket.io-parser"}],"references":[{"url":"https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/socketio/socket.io-parser/releases/tag/4.2.3","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://github.com/socketio/socket.io-parser/commit/1c220ddbf45ea4b44bc8dbf6f9ae245f672ba1b9","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32695","tags":["advisory"]},{"url":"https://github.com/socketio/socket.io-parser/commit/ee006607495eca4ec7262ad080dd3a91439a5ba4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cqmj-92xf-r6r9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32695.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-32695","tags":["advisory"]},{"url":"https://github.com/socketio/socket.io-parser","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-32695","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32695","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-32695","title":"Insufficient validation when decoding a Socket.IO packet","description":"socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.\n\n","status":"published","published":"2023-05-27T15:44:03.235Z","modified":"2025-01-13T21:03:34.13Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:29.381004Z"}],"euvd":[{"id":"EUVD-2023-1528","description":"socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.\n\n","status":"published","published":"2023-05-27T15:44:03Z","modified":"2025-01-13T21:03:34Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T00:04:20.377491Z"}],"ghsa":[{"id":"GHSA-cqmj-92xf-r6r9","title":"Insufficient validation when decoding a Socket.IO packet","description":"### Impact\n\nA specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.\n\n```\nTypeError: Cannot convert object to primitive value\n       at Socket.emit (node:events:507:25)\n       at .../node_modules/socket.io/lib/socket.js:531:14\n```\n\n### Patches\n\nA fix has been released today (2023/05/22):\n\n- https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3, included in `socket.io-parser@4.2.3`\n- https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced, included in `socket.io-parser@3.4.3`\n\n\nAnother fix has been released for the `3.3.x` branch:\n\n- https://github.com/socketio/socket.io-parser/commit/ee006607495eca4ec7262ad080dd3a91439a5ba4, included in `socket.io-parser@3.3.4\n\n| `socket.io` version | `socket.io-parser` version                                                                              | Needs minor update?                  |\n|---------------------|---------------------------------------------------------------------------------------------------------|--------------------------------------|\n| `4.5.2...latest`    | `~4.2.0` ([ref](https://github.com/socketio/socket.io/commit/9890b036cf942f6b6ad2afeb6a8361c32cd5d528)) | `npm audit fix` should be sufficient |\n| `4.1.3...4.5.1`     | `~4.1.1` ([ref](https://github.com/socketio/socket.io/commit/7c44893d7878cd5bba1eff43150c3e664f88fb57)) | Please upgrade to `socket.io@4.6.x`  |\n| `3.0.5...4.1.2`     | `~4.0.3` ([ref](https://github.com/socketio/socket.io/commit/752dfe3b1e5fecda53dae899b4a39e6fed5a1a17)) | Please upgrade to `socket.io@4.6.x`  |\n| `3.0.0...3.0.4`     | `~4.0.1` ([ref](https://github.com/socketio/socket.io/commit/1af3267e3f5f7884214cf2ca4d5282d620092fb0)) | Please upgrade to `socket.io@4.6.x`  |\n| `2.3.0...2.5.0`     | `~3.4.0` ([ref](https://github.com/socketio/socket.io/commit/cf39362014f5ff13a17168b74772c43920d6e4fd)) | `npm audit fix` should be sufficient |\n\n\n### Workarounds\n\nThere is no known workaround except upgrading to a safe version.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open a discussion [here](https://github.com/socketio/socket.io/discussions)\n\nThanks to [@rafax00](https://github.com/rafax00) for the responsible disclosure.\n","status":"published","published":"2023-05-23T19:55:13Z","modified":"2024-11-18T16:26:30Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-20","CWE-754"],"updated_at":"2026-11-02T14:38:19.029049Z"}],"nvd":[{"id":"CVE-2023-32695","description":"socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.\n\n","status":"published","published":"2023-05-27T16:15:09.433Z","modified":"2026-06-17T05:59:24.62Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20","CWE-754"],"updated_at":"2026-11-02T14:08:03.200773Z"}],"osv":[{"id":"CVE-2023-32695","title":"Insufficient validation when decoding a Socket.IO packet","description":"socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.\n\n","status":"published","published":"2023-05-27T15:44:03.235Z","modified":"2026-10-28T02:30:47.321886305Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:32.116263Z"},{"id":"DEBIAN-CVE-2023-32695","description":"socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.","status":"published","published":"2023-05-27T16:15:09.433Z","modified":"2026-10-26T18:03:05.543203453Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"GHSA-cqmj-92xf-r6r9","title":"Insufficient validation when decoding a Socket.IO packet","description":"### Impact\n\nA specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.\n\n```\nTypeError: Cannot convert object to primitive value\n       at Socket.emit (node:events:507:25)\n       at .../node_modules/socket.io/lib/socket.js:531:14\n```\n\n### Patches\n\nA fix has been released today (2023/05/22):\n\n- https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3, included in `socket.io-parser@4.2.3`\n- https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced, included in `socket.io-parser@3.4.3`\n\n\nAnother fix has been released for the `3.3.x` branch:\n\n- https://github.com/socketio/socket.io-parser/commit/ee006607495eca4ec7262ad080dd3a91439a5ba4, included in `socket.io-parser@3.3.4\n\n| `socket.io` version | `socket.io-parser` version                                                                              | Needs minor update?                  |\n|---------------------|---------------------------------------------------------------------------------------------------------|--------------------------------------|\n| `4.5.2...latest`    | `~4.2.0` ([ref](https://github.com/socketio/socket.io/commit/9890b036cf942f6b6ad2afeb6a8361c32cd5d528)) | `npm audit fix` should be sufficient |\n| `4.1.3...4.5.1`     | `~4.1.1` ([ref](https://github.com/socketio/socket.io/commit/7c44893d7878cd5bba1eff43150c3e664f88fb57)) | Please upgrade to `socket.io@4.6.x`  |\n| `3.0.5...4.1.2`     | `~4.0.3` ([ref](https://github.com/socketio/socket.io/commit/752dfe3b1e5fecda53dae899b4a39e6fed5a1a17)) | Please upgrade to `socket.io@4.6.x`  |\n| `3.0.0...3.0.4`     | `~4.0.1` ([ref](https://github.com/socketio/socket.io/commit/1af3267e3f5f7884214cf2ca4d5282d620092fb0)) | Please upgrade to `socket.io@4.6.x`  |\n| `2.3.0...2.5.0`     | `~3.4.0` ([ref](https://github.com/socketio/socket.io/commit/cf39362014f5ff13a17168b74772c43920d6e4fd)) | `npm audit fix` should be sufficient |\n\n\n### Workarounds\n\nThere is no known workaround except upgrading to a safe version.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open a discussion [here](https://github.com/socketio/socket.io/discussions)\n\nThanks to [@rafax00](https://github.com/rafax00) for the responsible disclosure.\n","status":"published","published":"2023-05-23T19:55:13Z","modified":"2024-11-18T16:26:29Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-20","CWE-754"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"UBUNTU-CVE-2023-32695","description":"socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.","status":"published","published":"2023-05-27T16:15:00Z","modified":"2025-10-24T05:02:02Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"CLSA-2026-1772496675","title":"TuxCare security update for socket.io-parser (3 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 3 CVEs. Fixed in 3.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:08Z","modified":"2026-10-15T09:47:46.249288204Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1791899634","title":"TuxCare security update for socket.io-parser (5 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 5 CVEs. Fixed in 2.3.1-tuxcare.1.","status":"published","published":"2026-10-13T13:53:54Z","modified":"2026-10-15T09:47:53.469310802Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792599106","title":"TuxCare security update for socket.io-parser (5 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 5 CVEs. Fixed in 2.2.2-tuxcare.1.","status":"published","published":"2026-10-21T16:11:46Z","modified":"2026-10-21T20:30:50.501354765Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792665531","title":"TuxCare security update for socket.io-parser (5 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 5 CVEs. Fixed in 2.2.4-tuxcare.1.","status":"published","published":"2026-10-22T10:38:51Z","modified":"2026-10-22T14:15:04.657404145Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"ROOT-APP-NPM-CVE-2023-32695","title":"CVE-2023-32695 in @rootio/socket.io-parser - Patched by Root","description":"Root has patched CVE-2023-32695 in the @rootio/socket.io-parser package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-04T20:57:20Z","modified":"2026-06-05T01:30:31.622184379Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}