Packages / socket.io / Security

HighVulnerabilityGHSA-qv2v-m59f-v5fwCVE-2017-16031Published 7 Nov 2018

Insecure randomness in socket.io

Your version

Affected releases · socket.io

  • 0.9.x0.9.0 – 0.9.6Fixed in 0.9.7
  • 0.8.x and older0.3.8 – 0.8.7No fix, no longer updated

On 0.9.x, the newest line:

npm install socket.io@0.9.7
Every release on a timeline
4.x

  1. Not affected

    4.0.0 – 4.8.4

    32 releases, latest

0.x

  1. Affected

    0.3.8 – 0.9.6

    49 releases

  2. Fixed

    0.9.7 – 0.9.19

    13 releases

151 stable releases of socket.io, oldest to newest, one row per major.

What happens

Affected versions of socket.io depend on Math.random() to create socket IDs, and therefore the IDs are predictable. With enough information on prior IDs, an attacker may be able to guess the socket ID and gain access to socket.io servers without authorization.

Recommendation

Update to v0.9.7 or later.