CVE-2023-32695: socket socket.io-parser Improper Input Validation
CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2023-32695DEBIAN-CVE-2023-32695GHSA-cqmj-92xf-r6r9
Published 27-05-2023Last modified 13-01-2025
Vulnerability summary
CVE-2023-32695 is a high (CVSS 7.5) Improper Input Validation vulnerability in socket socket.io-parser. EPSS estimates a 1.06% chance of exploitation in the next 30 days, higher than 63.9% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
1.06%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 27-05-2023PublishedVulnerability first disclosed.
- 13-01-2025Last modifiedVulnerability information updated.
Description
socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.
CVSS metrics
6 scores · 5 sources · 2 versionsMedium 6.9Preferred score · OSV · Npm (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NSourcesSingle source
High 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSources5 sources · 7.3–7.5
- CVE.orgCNA7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LDiffers
EPSS trend
Probability
1.06%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
0.00 pp
From 1.06% on 19-09-2026
19-09-202619-10-2026
EPSS score1.06%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Affected systems
Debian1 product
- node-socket.io-parser< 4.2.1+~3.1.0-2
Npm1 product
- socket.io-parser≥ 4.0.4, < 4.2.3 | ≥ 3.4.0, < 3.4.3 | < 3.3.4
Socket1 product
- socket.io-parser≥ 3.4.0, < 3.4.3 | ≥ 4.0.4, < 4.2.3
Socketio1 product
- socket.io-parser≥ 4.0.0, < 4.2.3 | ≥ 3.4.0, < 3.4.3
Ubuntu1 product
- node-socket.io-parserAll versions (No fix recorded)
5 vendors · 5 products
References
11 links- github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9X Refsource CONFIRMREPORTWEBVendor Advisory
- github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02cedX Refsource MISCREPORTWEBPatch
- github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3X Refsource MISCREPORTWEBPatch
