cve/2024/CVE-2024-38355.md

### [CVE-2024-38355](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38355)
![](https://img.shields.io/static/v1?label=Product&message=socket.io&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%202.5.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-754%3A%20Improper%20Check%20for%20Unusual%20or%20Exceptional%20Conditions&color=brighgreen)

### Description

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/Y0ursTruly/Y0ursTruly