🚨 [security] Update socket.io 2.4.1 → 2.5.1 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ socket.io (2.4.1 → 2.5.1) · Repo · Changelog

Security Advisories 🚨

🚨 socket.io has an unhandled 'error' event

Impact

A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.

node:events:502
    throw err; // Unhandled 'error' event
    ^
Error [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)

at new NodeError (node:internal/errors:405:5)

at Socket.emit (node:events:500:17)

at /myapp/node_modules/socket.io/lib/socket.js:531:14

at process.processTicksAndRejections (node:internal/process/task_queues:77:11) {

code: 'ERR_UNHANDLED_ERROR',

context: undefined

}

Affected versions

Version range	Needs minor update?
4.6.2...latest	Nothing to do
3.0.0...4.6.1	Please upgrade to socket.io@4.6.2 (at least)
2.3.0...2.5.0	Please upgrade to socket.io@2.5.1

Patches

This issue is fixed by 15af22f, included in socket.io@4.6.2 (released in May 2023).

The fix was backported in the 2.x branch today: d30630b

Workarounds

As a workaround for the affected versions of the socket.io package, you can attach a listener for the "error" event:

io.on("connection", (socket) => {
  socket.on("error", () => {
    // ...
  });
});

For more information

If you have any questions or comments about this advisory:

• Open a discussion here

Thanks a lot to Paul Taylor for the responsible disclosure.

References

• 15af22f
• d30630b

Release Notes

2.5.1

Bug Fixes

• add a noop handler for the error event (d30630b)

Links:

• Diff: 2.5.0...2.5.1
• Client release: -
• engine.io version: ~3.6.0 (no change)
• ws version: ~7.5.10

2.5.0

⚠️ WARNING ⚠️

The default value of the maxHttpBufferSize option has been decreased from 100 MB to 1 MB, in order to prevent attacks by denial of service.

Security advisory: GHSA-j4f2-536g-r55m

Bug Fixes

• fix race condition in dynamic namespaces (05e1278)
• ignore packet received after disconnection (22d4bdf)
• only set 'connected' to true after middleware execution (226cc16)
• prevent the socket from joining a room after disconnection (f223178)

Links:

• Diff: 2.4.1...2.5.0
• Client release: 2.5.0
• engine.io version: ~3.6.0 (diff)
• ws version: ~7.4.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 9 commits:

• chore(release): 2.5.1
• fix: add a noop handler for the error event
• test: fix tests on Node.js > 18
• chore(release): 2.5.0
• fix: prevent the socket from joining a room after disconnection
• fix: only set 'connected' to true after middleware execution
• fix: fix race condition in dynamic namespaces
• fix: ignore packet received after disconnection
• chore: update engine.io version to 3.6.0

↗️ socket.io-parser (indirect, 3.4.1 → 3.4.3) · Repo · Changelog

Security Advisories 🚨

🚨 Insufficient validation when decoding a Socket.IO packet

Impact

A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.

TypeError: Cannot convert object to primitive value
       at Socket.emit (node:events:507:25)
       at .../node_modules/socket.io/lib/socket.js:531:14

Patches

A fix has been released today (2023/05/22):

• 3b78117, included in socket.io-parser@4.2.3
• 2dc3c92, included in socket.io-parser@3.4.3

socket.io version	socket.io-parser version	Needs minor update?
4.5.2...latest	~4.2.0 (ref)	npm audit fix should be sufficient
4.1.3...4.5.1	~4.1.1 (ref)	Please upgrade to socket.io@4.6.x
3.0.5...4.1.2	~4.0.3 (ref)	Please upgrade to socket.io@4.6.x
3.0.0...3.0.4	~4.0.1 (ref)	Please upgrade to socket.io@4.6.x
2.3.0...2.5.0	~3.4.0 (ref)	npm audit fix should be sufficient

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

• Open a discussion here

Thanks to @rafax00 for the responsible disclosure.

🚨 Insufficient validation when decoding a Socket.IO packet

Due to improper type validation in the socket.io-parser library (which is used by the socket.io and socket.io-client packages to encode and decode Socket.IO packets), it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.

Example:

const decoder = new Decoder();
decoder.on("decoded", (packet) => {

console.log(packet.data); // prints [ 'hello', [Function: splice] ]

})
decoder.add('51-["hello",{"_placeholder":true,"num":"splice"}]');

decoder.add(Buffer.from("world"));

This bubbles up in the socket.io package:

io.on("connection", (socket) => {
 socket.on("hello", (val) => {
 // here, "val" could be a function instead of a buffer
 });
});

⚠️ IMPORTANT NOTE ⚠️

You need to make sure that the payload that you received from the client is actually a Buffer object:

io.on("connection", (socket) => {
 socket.on("hello", (val) => {
 if (!Buffer.isBuffer(val)) {
 socket.disconnect();
 return;
 }
 // ...
 });
});

If that's already the case, then you are not impacted by this issue, and there is no way an attacker could make your server crash (or escalate privileges, ...).

Example of values that could be sent by a malicious user:

• a number that is out of bounds

Sample packet: 451-["hello",{"_placeholder":true,"num":10}]

io.on("connection", (socket) => {
 socket.on("hello", (val) => {
 // val is `undefined`
 });
});

• a value that is not a number, like undefined

Sample packet: 451-["hello",{"_placeholder":true,"num":undefined}]

io.on("connection", (socket) => {
 socket.on("hello", (val) => {
 // val is `undefined`
 });
});

• a string that is part of the prototype of Array, like "push"

Sample packet: 451-["hello",{"_placeholder":true,"num":"push"}]

io.on("connection", (socket) => {
 socket.on("hello", (val) => {
 // val is a reference to the "push" function
 });
});

• a string that is part of the prototype of Object, like "hasOwnProperty"

Sample packet: 451-["hello",{"_placeholder":true,"num":"hasOwnProperty"}]

io.on("connection", (socket) => {
 socket.on("hello", (val) => {
 // val is a reference to the "hasOwnProperty" function
 });
});

This should be fixed by:

• b5d0cb7, included in socket.io-parser@4.2.1
• b559f05, included in socket.io-parser@4.0.5
• 04d23ce, included in socket.io-parser@3.4.2
• fb21e42, included in socket.io-parser@3.3.3

Dependency analysis for the socket.io package

socket.io version	socket.io-parser version	Covered?
4.5.2...latest	~4.2.0 (ref)	Yes ✔️
4.1.3...4.5.1	~4.0.4 (ref)	Yes ✔️
3.0.5...4.1.2	~4.0.3 (ref)	Yes ✔️
3.0.0...3.0.4	~4.0.1 (ref)	Yes ✔️
2.3.0...2.5.0	~3.4.0 (ref)	Yes ✔️

Dependency analysis for the socket.io-client package

socket.io-client version	socket.io-parser version	Covered?
4.5.0...latest	~4.2.0 (ref)	Yes ✔️
4.3.0...4.4.1	~4.1.1 (ref)	No, but the impact is very limited
3.1.0...4.2.0	~4.0.4 (ref)	Yes ✔️
3.0.5	~4.0.3 (ref)	Yes ✔️
3.0.0...3.0.4	~4.0.1 (ref)	Yes ✔️
2.2.0...2.5.0	~3.3.0 (ref)	Yes ✔️

Release Notes

3.4.3

⚠️ This release contains an important security fix ⚠️

A malicious client could send a specially crafted HTTP request, triggering an uncaught exception and killing the Node.js process:

TypeError: Cannot convert object to primitive value
       at Socket.emit (node:events:507:25)
       at .../node_modules/socket.io/lib/socket.js:531:14

Please upgrade as soon as possible.

Bug Fixes

• check the format of the event name (2dc3c92)

Links

• Diff: 3.4.2...3.4.3

3.4.2 (from changelog)

Bug Fixes

• check the format of the index of each attachment (04d23ce)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• chore(release): 3.4.3
• fix: check the format of the event name
• chore(release): 3.4.2
• fix: check the format of the index of each attachment
• test: add Node.js 12 and 14 in the build matrix

🆕 engine.io (added, 3.5.0)

🆕 engine.io-client (added, 3.5.4)

🆕 parseqs (added, 0.0.6)

🆕 parseuri (added, 0.0.6)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)