GHSA-hhr9-rh25-hvf9

Feathers socket handler allows abusing implicit toString

Source: GitHub Advisory Database (reviewed) High CVE-2023-37899

Packages

Ecosystem	Package	Affected	Fixed in
npm	@feathersjs/socketio	< 4.5.18	4.5.18
npm	@feathersjs/socketio	>= 5.0.0, < 5.0.8	5.0.8
npm	@feathersjs/transport-commons	< 4.5.18	4.5.18
npm	@feathersjs/transport-commons	>= 5.0.0, < 5.0.8	5.0.8

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Feathers socket handler did not catch invalid string conversion errors like: ```ts const message = `${{ toString: '' }}` ``` Causing the NodeJS process to crash when sending an unexpected Socket.io message like ```ts socket.emit('find', { toString: '' }) ``` ### Patches A fix has been released in - `v5.0.8` via #3241 - `v4.5.18` via #3242 ### Workarounds Since it is in the core Socket handling code upgrading to the latest version is necessary. ### References - [v5.0.8 Changelog](https://github.com/feathersjs/feathers/blob/dove/CHANGELOG.md#508-2023-07-19) - [v4.5.18 Changelog](https://github.com/feathersjs/feathers/blob/crow/CHANGELOG.md#4518-2023-07-19)

References

External links from the advisory. They lead to third-party sites.