CVE-2024-38355highCWE-20CWE-754

CVE-2024-38355: fallo de gravedad alta en socketio socket.io

Unhandled 'error' event in socket.io

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear socket.io+ Monitorear socket.io

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.3epss 0.8%
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Productos afectados
socketio · socket.io
CVEs relacionadas — socketio socket.io

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-69185HIGHSocket.IO: Zero-attachment Memory ExhaustionEPSS 0.6%CVE-2026-59724HIGHSocket.IO: Engine.IO WebTransport SID DoSEPSS 0.6%CVE-2026-102599HIGHSocket.IO: Engine.IO Protocol Revision Mismatch DoSEPSS 0.6%CVE-2026-33151HIGHsocket.io allows an unbounded number of binary attachmentsEPSS 0.5%CVE-2026-102600HIGHSocket.IO: Prototype Pollution via Unsafe Client Session LookupEPSS 0.4%