Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2022-2421: socket.io-parser package can be tricked into running unwanted code
CVE-2022-2421 · published 1 day ago
Summary
The JavaScript library socket.io-parser, used in several projects, had a weakness that could let an attacker cause the program to execute code it shouldn't. This could lead to data loss or unauthorized actions. Update to the latest version of the library as provided by the maintainers to close the gap.
What to do
- Update GitHub Actions socket.io-parser to version 4.2.1.
- Update GitHub Actions socket.io-parser to version 4.0.5.
- Update GitHub Actions socket.io-parser to version 3.3.3.
- Update GitHub Actions socket.io-parser to version 3.4.2.
- Update socket.io-parser to version 4.0.5-aikido.2.
- Update rootio @rootio/socket.io-parser to version 4.0.5-root.io.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | socket.io-parser |
>= 4.1.0, < 4.2.1 >= 4.0.0, < 4.0.5 < 3.3.3 >= 3.4.0, < 3.4.2 Fix: upgrade to 4.2.1
|
| – | socket | socket.io-parser |
< 3.3.3 >= 3.4.0, < 3.4.2 >= 4.0.0, < 4.0.5 >= 4.1.0, < 4.2.1 cpe:2.3:a:socket:socket.io-parser:*:*:*:*:*:node.js:*:* |
| Root:npm | – | socket.io-parser |
< 4.0.5-aikido.2 Fix: upgrade to 4.0.5-aikido.2
|
| Root:npm | rootio | @rootio/socket.io-parser |
< 4.0.5-root.io.2 Fix: upgrade to 4.0.5-root.io.2
|
Original advisory text
CVE-2022-2421 in socket.io-parser - Patched by Root
Root has patched CVE-2022-2421 in the socket.io-parser package for Root:npm. Multiple fixed versions available.
References
- https://csirt.divd.nl/CVE-2022-2421 Vendor Advisory
- https://csirt.divd.nl/DIVD-2022-00045 Vendor Advisory
- https://csirt.divd.nl/cases/DIVD-2022-00045
- https://csirt.divd.nl/cves/CVE-2022-2421
- https://github.com/socketio/socket.io-parser/commit/b559f050ee02bd90bd853b9823f8...
- https://github.com/socketio/socket.io-parser/commit/b5d0cb7dc56a0601a09b056beaee...
- https://github.com/socketio/socket.io-parser/commit/04d23cecafe1b859fb03e0cbf6ba...
- https://github.com/socketio/socket.io-parser/commit/fb21e422fc193b34347395a33e0f...
- https://github.com/advisories/GHSA-qm95-pgcg-qqfq
- https://nvd.nist.gov/vuln/detail/CVE-2022-2421 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2421.j... Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-20Improper Input Validation
CWE-89SQL Injection
CWE-1287Improper Validation of Specified Type of Input
Timeline
Published11 Nov 2026
Updated11 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta