cve/2023/CVE-2023-32695.md

### [CVE-2023-32695](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32695)
![](https://img.shields.io/static/v1?label=Product&message=socket.io-parser&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3E%3D%204.0.0%2C%20%3C%204.2.3%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brighgreen)

### Description

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/OneIdentity/IdentityManager.Imx
- https://github.com/trong0dn/eth-todo-list