Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-69185 →

DEBIAN-CVE-2026-69185

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO pack...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 node-socket.io-parser

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 node-socket.io-parser

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 node-socket.io-parser

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4+~3.1.2-1"}]}]

Références

advisory security-tracker.debian.org