socket.io

4.8.4 · 25 Sep 2026MIT16.6M / weekRepository Homepage npm Atom feed

Your version

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Line	Newest	Where it stands
	4.8.4	Safe from 4.6.2
	3.1.2	23 open advisories, worst high · last release Feb 2021, no longer updated

High
Insecure randomness in socket.ioGHSA-qv2v-m59f-v5fw · 7 Nov 2018
fixed in 0.9.7
Moderate
socket.io has an unhandled 'error' eventGHSA-25hc-qcg6-38wj · 19 Jun 2024
fixed in 4.6.2, 2.5.1
Moderate
CORS misconfiguration in socket.ioGHSA-fxwf-4rqh-v8g3 · 20 Jan 2021
fixed in 2.4.0

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 28 Oct 2026. Releases and advisories last read 28 Oct 2026.