CVE-2024-38355highCWE-20CWE-754

CVE-2024-38355: high-severity vulnerability in socketio socket.io

Unhandled 'error' event in socket.io

Published · Updated

Follow this CVE+ Monitor socket.io+ Monitor socket.io

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.3epss 0.8%
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
socketio · socket.io
Related CVEs — socketio socket.io

In the same product, most dangerous first.

CVE-2026-69185HIGHSocket.IO: Zero-attachment Memory ExhaustionEPSS 0.6%CVE-2026-59724HIGHSocket.IO: Engine.IO WebTransport SID DoSEPSS 0.6%CVE-2026-102599HIGHSocket.IO: Engine.IO Protocol Revision Mismatch DoSEPSS 0.6%CVE-2026-33151HIGHsocket.io allows an unbounded number of binary attachmentsEPSS 0.5%CVE-2026-102600HIGHSocket.IO: Prototype Pollution via Unsafe Client Session LookupEPSS 0.4%