High severityNVD Advisory· Published Jan 7, 2021· Updated Aug 4, 2024
CVE-2020-36049
CVE-2020-36049
Description
socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
socket.io-parsernpm | < 3.3.2 | 3.3.2 |
socket.io-parsernpm | >= 3.4.0, < 3.4.1 | 3.4.1 |
Affected products
2- socket.io-parser/socket.io-parserdescription
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-xfhh-g9f5-x4m4ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-36049ghsaADVISORY
- blog.caller.xyz/socketio-engineio-dosghsaWEB
- blog.caller.xyz/socketio-engineio-dos/mitrex_refsource_MISC
- github.com/socketio/socket.io-parser/commit/dcb942d24db97162ad16a67c2a0cf30875342d55ghsax_refsource_MISCWEB
- github.com/socketio/socket.io-parser/releases/tag/3.3.2ghsaWEB
- github.com/socketio/socket.io-parser/releases/tag/3.4.1ghsaWEB
- www.npmjs.com/package/socket.io-parserghsaWEB
News mentions
0No linked articles in our index yet.