GHSA-hhr9-rh25-hvf9HighCVSS 7.5

Feathers socket handler allows abusing implicit toString

Published
July 20, 2023
Last Modified
November 7, 2023

🔗 CVE IDs covered (1)

CVE-2023-37899 →

📋 Description

Impact

Feathers socket handler did not catch invalid string conversion errors like:

const message = `${{ toString: '' }}`

Causing the NodeJS process to crash when sending an unexpected Socket.io message like

socket.emit('find', { toString: '' })

Patches

A fix has been released in

  • v5.0.8 via #3241
  • v4.5.18 via #3242

Workarounds

Since it is in the core Socket handling code upgrading to the latest version is necessary.

References

🎯 Affected products4

  • npm/@feathersjs/socketio:<= 4.5.17
  • npm/@feathersjs/socketio:>= 5.0.0, <= 5.0.7
  • npm/@feathersjs/transport-commons:<= 4.5.17
  • npm/@feathersjs/transport-commons:>= 5.0.0, <= 5.0.7

🔗 References (9)