{"id":"CVE-2024-38355","aliases":["CLSA-2026-1776818218","CLSA-2026-1789549941","CLSA-2026-1792604680","CLSA-2026-1793304087","EUVD-2024-1878","GHSA-25hc-qcg6-38wj","ROOT-APP-NPM-CVE-2024-38355","SUSE-SU-2024:3771-1"],"status":"published","title":"Unhandled 'error' event in socket.io","description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the \"error\" event to catch these errors.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00807,"percentile":0.57094,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20","CWE-754"],"published":"2024-06-19T15:04:41Z","modified":"2026-11-06T11:15:09Z","exploits":[{"source":"pocgithub","id":"PawelMurdzek/CVE-2024-38355-PoC","title":"PawelMurdzek/CVE-2024-38355-PoC","date":"2025-12-23","url":"https://github.com/PawelMurdzek/CVE-2024-38355-PoC"}],"fixes":[{"ecosystem":"npm","package":"socket.io","fixed_in":["4.6.2","2.5.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"socket.io","fixed_in":["3.1.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"socket.io","fixed_in":["3.1.2-aikido.2","3.1.2-aikido.3","2.0.3-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/socket.io","fixed_in":["3.1.2-root.io.1","3.1.2-root.io.2","3.1.2-root.io.3","2.0.3-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"socket.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"4.6.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"socket.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.4-tuxcare.0"},{"fixed":"2.0.4-tuxcare.1"}]}],"versions":["2.0.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-tuxcare.0"},{"fixed":"3.1.1-tuxcare.1"}]}],"versions":["3.1.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.4-tuxcare.0"},{"fixed":"1.7.4-tuxcare.1"}]}],"versions":["1.7.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.3-tuxcare.0"},{"fixed":"1.7.3-tuxcare.1"}]}],"versions":["1.7.3"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"socket.io","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.5.1"}]}]},{"source":"osv","ecosystem":"npm","package":"socket.io","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"4.6.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"socket.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-aikido.2"},{"fixed":"3.1.2-aikido.3"},{"fixed":"2.0.3-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/socket.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-root.io.1"},{"fixed":"3.1.2-root.io.2"},{"fixed":"3.1.2-root.io.3"},{"fixed":"2.0.3-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.6.1"}]}],"bundled":10}],"products":[{"vendor":"socket","product":"socket.io"},{"vendor":"socketio","product":"socket.io"}],"references":[{"url":"https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://www.vicarius.io/vsociety/posts/unhandled-exception-in-socketio-cve-2024-38355","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38355","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-25hc-qcg6-38wj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38355.json","tags":["advisory"]},{"url":"https://github.com/socketio/socket.io","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224295","tags":["report"]},{"url":"https://bugzilla.suse.com/1224366","tags":["report"]},{"url":"https://bugzilla.suse.com/1226967","tags":["report"]},{"url":"https://bugzilla.suse.com/1227248","tags":["report"]},{"url":"https://bugzilla.suse.com/1227252","tags":["report"]},{"url":"https://bugzilla.suse.com/1229423","tags":["report"]},{"url":"https://bugzilla.suse.com/1229861","tags":["report"]},{"url":"https://bugzilla.suse.com/1230928","tags":["report"]},{"url":"https://bugzilla.suse.com/1231564","tags":["report"]},{"url":"https://bugzilla.suse.com/1231684","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9014","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-38355","title":"Unhandled 'error' event in socket.io","description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the \"error\" event to catch these errors.\n","status":"published","published":"2024-06-19T19:48:50.193Z","modified":"2024-09-03T20:35:40.515Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-20","CWE-754"],"updated_at":"2026-11-02T14:34:16.007021Z"}],"euvd":[{"id":"EUVD-2024-1878","description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the \"error\" event to catch these errors.\n","status":"published","published":"2024-06-19T19:48:50Z","modified":"2024-09-03T20:35:40Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T00:56:05.029422Z"}],"ghsa":[{"id":"GHSA-25hc-qcg6-38wj","title":"socket.io has an unhandled 'error' event","description":"### Impact\n\nA specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.\n\n```\nnode:events:502\n    throw err; // Unhandled 'error' event\n    ^\n\nError [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)\n    at new NodeError (node:internal/errors:405:5)\n    at Socket.emit (node:events:500:17)\n    at /myapp/node_modules/socket.io/lib/socket.js:531:14\n    at process.processTicksAndRejections (node:internal/process/task_queues:77:11) {\n  code: 'ERR_UNHANDLED_ERROR',\n  context: undefined\n}\n```\n\n### Affected versions\n\n| Version range    | Needs minor update?                            |\n|------------------|------------------------------------------------|\n| `4.6.2...latest` | Nothing to do               |\n| `3.0.0...4.6.1`  | Please upgrade to `socket.io@4.6.2` (at least) |\n| `2.3.0...2.5.0`  | Please upgrade to `socket.io@2.5.1`            |\n\n### Patches\n\nThis issue is fixed by https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115, included in `socket.io@4.6.2` (released in May 2023).\n\nThe fix was backported in the 2.x branch today: https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c\n\n### Workarounds\n\nAs a workaround for the affected versions of the `socket.io` package, you can attach a listener for the \"error\" event:\n\n```js\nio.on(\"connection\", (socket) =\u003e {\n  socket.on(\"error\", () =\u003e {\n    // ...\n  });\n});\n```\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open a discussion [here](https://github.com/socketio/socket.io/discussions)\n\nThanks a lot to [Paul Taylor](https://github.com/Y0ursTruly) for the responsible disclosure.\n\n### References\n\n- https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115\n- https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c","status":"published","published":"2024-06-19T15:04:41Z","modified":"2026-09-24T14:45:27Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-20","CWE-754"],"updated_at":"2026-11-02T14:41:21.616682Z"}],"nvd":[{"id":"CVE-2024-38355","description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the \"error\" event to catch these errors.\n","status":"published","published":"2024-06-19T20:15:11.18Z","modified":"2026-06-17T07:39:58.987Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-20","CWE-754"],"updated_at":"2026-11-02T14:10:07.173605Z"}],"osv":[{"id":"CVE-2024-38355","title":"Unhandled 'error' event in socket.io","description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the \"error\" event to catch these errors.\n","status":"published","published":"2024-06-19T19:48:50.193Z","modified":"2026-10-28T02:30:43.806590872Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-20","CWE-754"],"updated_at":"2026-11-02T15:44:41.133403Z"},{"id":"GHSA-25hc-qcg6-38wj","title":"socket.io has an unhandled 'error' event","description":"### Impact\n\nA specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.\n\n```\nnode:events:502\n    throw err; // Unhandled 'error' event\n    ^\n\nError [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)\n    at new NodeError (node:internal/errors:405:5)\n    at Socket.emit (node:events:500:17)\n    at /myapp/node_modules/socket.io/lib/socket.js:531:14\n    at process.processTicksAndRejections (node:internal/process/task_queues:77:11) {\n  code: 'ERR_UNHANDLED_ERROR',\n  context: undefined\n}\n```\n\n### Affected versions\n\n| Version range    | Needs minor update?                            |\n|------------------|------------------------------------------------|\n| `4.6.2...latest` | Nothing to do               |\n| `3.0.0...4.6.1`  | Please upgrade to `socket.io@4.6.2` (at least) |\n| `2.3.0...2.5.0`  | Please upgrade to `socket.io@2.5.1`            |\n\n### Patches\n\nThis issue is fixed by https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115, included in `socket.io@4.6.2` (released in May 2023).\n\nThe fix was backported in the 2.x branch today: https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c\n\n### Workarounds\n\nAs a workaround for the affected versions of the `socket.io` package, you can attach a listener for the \"error\" event:\n\n```js\nio.on(\"connection\", (socket) =\u003e {\n  socket.on(\"error\", () =\u003e {\n    // ...\n  });\n});\n```\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open a discussion [here](https://github.com/socketio/socket.io/discussions)\n\nThanks a lot to [Paul Taylor](https://github.com/Y0ursTruly) for the responsible disclosure.\n\n### References\n\n- https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115\n- https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c","status":"published","published":"2024-06-19T15:04:41Z","modified":"2026-09-24T15:00:04.702589955Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-20","CWE-754"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"ROOT-APP-NPM-CVE-2024-38355","title":"CVE-2024-38355 in socket.io - Patched by Root","description":"Root has patched CVE-2024-38355 in the socket.io package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-06T10:41:41Z","modified":"2026-11-06T11:15:09.539567674Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-06T11:42:45.055937Z"},{"id":"CLSA-2026-1776818218","title":"TuxCare security update for socket.io (2 CVEs)","description":"TuxCare rebuilt socket.io to address 2 CVEs. Fixed in 2.0.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:45:46.410156309Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1789549941","title":"TuxCare security update for socket.io (1 CVE)","description":"TuxCare rebuilt socket.io to address 1 CVE. Fixed in 3.1.1-tuxcare.1.","status":"published","published":"2026-09-16T09:12:21Z","modified":"2026-10-15T09:47:56.183621118Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1792604680","title":"TuxCare security update for socket.io (2 CVEs)","description":"TuxCare rebuilt socket.io to address 2 CVEs. Fixed in 1.7.4-tuxcare.1.","status":"published","published":"2026-10-21T17:44:40Z","modified":"2026-10-21T20:30:49.850653542Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1793304087","title":"TuxCare security update for socket.io (2 CVEs)","description":"TuxCare rebuilt socket.io to address 2 CVEs. Fixed in 1.7.3-tuxcare.1.","status":"published","published":"2026-10-29T21:01:28Z","modified":"2026-10-30T02:15:06.331434472Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"SUSE-SU-2024:3771-1","title":"Security update for pgadmin4","description":"This update for pgadmin4 fixes the following issues:\n\n- CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967)\n- CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248)\n- CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252)\n- CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios (bsc#1229423)\n- CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS) (bsc#1224366)\n- CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion (bsc#1224295)\n- CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS (bsc#1229861)\n- CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic (bsc#1231684)\n- CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (bsc#1231564)\n- CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928)\n","status":"published","published":"2024-10-29T12:55:34Z","modified":"2026-02-04T02:25:55.097314Z","updated_at":"2026-11-02T15:53:55.639015Z"}]}}