Packages / socket.io / Security

ModerateVulnerabilityGHSA-fxwf-4rqh-v8g3CVE-2020-28481Published 20 Jan 2021

CORS misconfiguration in socket.io

Your version

Affected releases · socket.io

  • 2.x2.0.0 – 2.3.0Fixed in 2.4.0
  • 1.x and older0.3.8 – 1.7.4No fix, no longer updated

On 2.x, the newest line:

npm install socket.io@2.4.0
Every release on a timeline
4.x

  1. Not affected

    4.0.0 – 4.8.4

    32 releases, latest

2.x

  1. Affected

    2.0.0 – 2.3.0

    9 releases

  2. Fixed

    2.4.0 – 2.5.1

    4 releases

1.x

  1. Affected

    1.0.0 – 1.7.4

    35 releases

0.x

  1. Affected

    0.3.8 – 0.9.19

    62 releases

151 stable releases of socket.io, oldest to newest, one row per major.

What happens

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.