socket.io-parser - Insufficient validation when decoding a Socket.IO packet

[ritikaGupta4]

What version of socket.io-client are you using?

socket.io-client v2.5.0

GHSA-cqmj-92xf-r6r9

Expected Behavior

The version of socket.io-client doesn't use a vulnerable version of socket.io-parser

Actual Behavior

npm audit report currently shows vulnerabilities.

[darrachequesne]

Hi! socket.io-parser@3.3.4 has been patched.

Reference: https://github.com/socketio/socket.io-parser/releases/tag/3.3.4

$ npm i socket.io-client@2

added 23 packages, changed 3 packages, and audited 49 packages in 1s

1 package is looking for funding
  run `npm fund` for details

found 0 vulnerabilities

$ npm ls socket.io-parser
socket.io@ /home/damien/git/socket.io
├─┬ socket.io-client@2.5.0
│ └── socket.io-parser@3.3.4
└─┬ socket.io@4.7.5
  └── socket.io-parser@4.2.4

[ritikaGupta4]

Do we have any stable version in 2.x.x for socket.io-client as we don't want to do major change.

[darrachequesne]

You should be able to bump socket.io-parser from 3.3.3 to 3.3.4. Would that work for you?

[ritikaGupta4]

No, actually we aren't using socket.io-parser directly but socket.io-client so as a dependency it is creating the issue. Hence we need a stable version of socket.io-client.

[darrachequesne]

I understand. However, as socket.io-client@2.5.0 depends on socket.io-parser@~3.3.0 (please notice the ~ range), running npm audit fix or npm update socket.io-parser should bring the right version of the socket.io-parser package. Could you please check?

[ritikaGupta4]

Tried this, but it shows already up-to-date

[darrachequesne]

Oh, I see, that's because pnpm update does not update transitive dependencies. Could you please try with pnpm audit --fix followed by pnpm install?

Reference: https://pnpm.io/cli/audit#--fix

If it does not work, could you please indicate which version of pnpm you are using?

[ritikaGupta4]

This also didn't work. It just added socket.io-parser in overrides.

pnpm version: 7.20.0

[darrachequesne]

I'm out of ideas then... Maybe uninstall then reinstall the socket.io-client package?