Socket.Io vulnerabilities

2 vulnerabilities

Known vulnerabilities in Socket.Io, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.3CVE-2020-28481Npmsocket.io+1
EPSS score
0.74%
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.7.5CVE-2017-16031hackeronesocket.io node module+2
EPSS score
1.97%
Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtaining sensitive information.