Find, fix and prevent vulnerabilities in your code.

Overview

engine.io is a realtime engine behind Socket.IO. It provides the foundation of a bidirectional connection between client and server

Affected versions of this package are vulnerable to Improper Resource Shutdown or Release through the polling request handler in Polling transport processing. An attacker can consume server-side sockets and related HTTP resources by sending an invalid Engine.IO v4 polling POST request with Content-Type: application/octet-stream after establishing a polling session. The vulnerable code reports invalid content but leaves the HTTP response open, so repeated malformed requests can accumulate unfinished connections. This can prevent legitimate clients from connecting and exhaust available file descriptors or connection slots on the server.

Notes

• The vulnerable path is limited to Engine.IO protocol v4 polling POST requests that present Content-Type: application/octet-stream; other polling traffic is not in scope for this issue.

Workarounds

• Block or reject Engine.IO protocol v4 polling POST requests with Content-Type: application/octet-stream at a reverse proxy, load balancer, WAF, or application middleware to prevent the malformed request path that can leave HTTP connections open and consume sockets/resources.
• Disable HTTP long-polling and use WebSocket-only transport if your deployment and clients support it to prevent exposure of the vulnerable polling handler.
• Enforce strict request and connection timeouts at the HTTP server, reverse proxy, or load balancer to limit how long malformed polling requests can hold server-side connections open.
• Apply per-IP rate limits and connection limits for Engine.IO endpoints to reduce the ability to repeat the crafted polling requests and exhaust server resources.
• Restrict access to the Socket.IO/Engine.IO endpoint where feasible to limit who can reach the vulnerable polling transport.

Remediation

Upgrade engine.io to version 6.6.7 or higher.

References

• GitHub Commit
• Maintainer's Advisory

Overview

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the addressparser function in lib/addressparser/index.js. An attacker can block the Node.js event loop by supplying a crafted comma-separated address list, such as a To, Cc, Bcc, From, or Reply-To header value, that forces the parser to spend CPU time proportional to the square of the input size. This stalls email processing and delays or freezes every other request handled by the same process.

Remediation

Upgrade nodemailer to version 9.1.0 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub PR
• Maintainer's Advisory

Overview

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the address parser in src/addressparser/index.ts, where the regex /\s*\b[^@\s]+@[^\s]+\b\s*/ was used to search free text for an email address. The [^@\s]+ quantifier causes quadratic backtracking: from every offset it rescans the run up to the next @ and then fails, advancing one character and repeating. An attacker who can supply a long whitespace-free string containing no usable @ character can block the Node.js event loop for tens of seconds, with 273 KB of input producing approximately 43 seconds of blocking.

Remediation

Upgrade nodemailer to version 10.0.6 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

socket.io is a node.js realtime framework server.

Affected versions of this package are vulnerable to Uncaught Exception in handling error events. If there is no listener set up for such events, an attacker can send packets containing them to crash the Node process.

Workaround

This vulnerability can be avoided by attaching a listener for error events, such as

io.on("connection", (socket) => {
  socket.on("error", () => {
    // ...
  });
});

Remediation

Upgrade socket.io to version 2.5.1, 4.6.2 or higher.

References

• GitHub Commit
• GitHub Commit

Overview

socket.io-parser is a socket.io protocol parser

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Decoder class, which accepts an unlimited number of binary attachments. An attacker can exploit this to exhaust server memory.

Remediation

Upgrade socket.io-parser to version 3.3.5, 3.4.4, 4.2.6 or higher.

References

• GitHub Commit
• GitHub Commit

Overview

socket.io-parser is a socket.io protocol parser

Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via attachment handling. An attacker can cause the server to exhaust memory resources by sending specially crafted packets that make the server wait for and buffer a large number of binary attachments.

Remediation

Upgrade socket.io-parser to version 3.3.6, 3.4.5, 4.2.7 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub Commit

Overview

ws is a simple to use websocket client, server and console for node.js.

Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) when handling a large number of very small fragments and data chunks. An attacker can cause excessive memory allocation and OOM by sending a high volume of tiny WebSocket frames

Workaround

This vulnerability can be mitigated by lowering the value of the maxPayload option.

PoC

import { WebSocket, WebSocketServer } from 'ws';

const wss = new WebSocketServer({ port: 0 }, function () {
  const data = Buffer.alloc(1);
  const options = { fin: false };
  const { port } = wss.address();
  const ws = new WebSocket(`ws://localhost:${port}`);

  ws.on('open', function () {
    (function send() {
      ws.send(data, options, function (err) {
        if (err) return;
        send();
      });
    })();
  });

  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`client close - code: ${code} reason: ${reason.toString()}`);
  });
});

wss.on('connection', function (ws) {
  ws.on('error', console.error);
  ws.on('close', function (code, reason) {
    console.log(`server close - code: ${code} reason: ${reason.toString()}`);
  });
});

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade ws to version 5.2.5, 6.2.4, 7.5.11, 8.21.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• Red Hat Bugzilla Bug

Overview

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Interpretation Conflict via RFC 5322 comment mis-parsing in lib/addressparser/index.js. An attacker can make mail be delivered to an attacker-controlled domain by supplying a recipient such as user@good-corp.com(x)evil.com, which the parser glues into good-corp.comevil.com instead of treating the comment as folding whitespace. Applications that approve recipients by parsing or matching the domain separately can be tricked into sending mail to a domain they never intended to allow, exposing messages to the attacker-controlled recipient.

Remediation

Upgrade nodemailer to version 9.1.0 or higher.

References

• GitHub Commit
• GitHub PR
• Maintainer's Advisory

Overview

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Interpretation Conflict through _normalizeAddress in lib/mime-node/index.js. An attacker can cause mail to be delivered to an attacker-controlled domain by supplying a recipient address whose domain contains an IDN-mapped or ignored code point, such as an invisible soft hyphen, that a standards-compliant domain check resolves to a trusted domain but Nodemailer encodes to a different xn-- label. This can make an application approve or display one recipient domain while Nodemailer sends the message to another external domain, exposing the intended email content and breaking domain-based recipient controls.

Remediation

Upgrade nodemailer to version 9.1.0 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub PR
• Maintainer's Advisory

Overview

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts when processing email header values containing nested comments. RFC 5322 §3.2.2 defines comments as nestable, but the tokenizer ends a comment at the first ) encountered, so the ) closing an inner comment prematurely closes the outer one and releases the remaining comment text, including any address it contains, into the parsed header. An attacker can construct a To header such as Victim (x(y) <evil@evil.com>) <v@victim.com> to redirect delivery to evil@evil.com instead of the intended v@victim.com, because the envelope RCPT TO is derived from the same malformed parse.

PoC

const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("Victim (x(y) <evil@evil.com>) <v@victim.com>"));
// [ { address: 'evil@evil.com', name: 'Victim) v@victim.com' } ]

Python's email._header_value_parser.get_address_list reads the same value as v@victim.com with the display name Victim, with no defects reported.

The envelope a message gets is built from the same parse, so sendMail({ to: "Victim (x(y) <evil@evil.com>) <v@victim.com>" }) issues the RCPT TO shown above.

Note: The PoC states no specific environment, runtime version, or operating system.

Remediation

Upgrade nodemailer to version 10.1.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts, where the tokenizer tracks only a single open operator and does not account for quoted strings, comments, or domain literals nested inside an angle-addr or group. An attacker who controls a recipient address can supply a value such as 'G: (a; <evil@evil.com>) <v@victim.com>;' to cause the parser to terminate the group at the ; inside the comment, resulting in evil@evil.com being added to the SMTP envelope as a recipient instead of, or in addition to, the intended address. Similarly, a quoted local part containing > prematurely closes an angle-addr, so <"a@evil.com>"@good.com> is resolved to evil.com rather than good.com.

PoC

const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("G: (a; <evil@evil.com>) <v@victim.com>;"));
// [ { name: 'G', group: [ [Object] ] }, { address: 'evil@evil.com', name: ') v@victim.com' } ]

Python's email._header_value_parser.get_address_list reads the same value as the single mailbox v@victim.com, with no defects reported.

The envelope a message gets is built from the same parse, so sendMail({ to: "G: (a; <evil@evil.com>) <v@victim.com>;" }) issues the RCPT TO shown above.

Note: The PoC uses the addressparser module bundled with nodemailer and states no specific version, OS, or non-default configuration.

Remediation

Upgrade nodemailer to version 10.1.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Interpretation Conflict via the address parser (src/addressparser/index.ts) when processing angle-addr and group constructs. The tokenizer tracks only a single open operator and, once < or : is encountered, looks only for the closing > or ; without accounting for quoted strings, comments, or domain literals that may appear inside. A > character inside a quoted local part therefore terminates the angle-addr prematurely, so an input such as <"a@evil.com>"@good.com> is parsed as an address at evil.com rather than the RFC 5322-conformant mailbox "a@evil.com>"@good.com. Similarly, a ; inside a quoted display name or a comment prematurely closes a group, causing additional recipients to be injected into the envelope, so G: (a; <evil@evil.com>) <v@victim.com>; delivers only to evil@evil.com instead of v@victim.com.

PoC

const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("<\"a@evil.com>\"@good.com>"));
// [ { address: '"a@evil.com', name: '@good.com>' } ]

Python's email._header_value_parser.get_address_list reads the same value as "a@evil.com>"@good.com, with no defects reported.

The envelope a message gets is built from the same parse, so sendMail({ to: "<\"a@evil.com>\"@good.com>" }) issues the RCPT TO shown above.

Note: The PoC states no specific environment, runtime version, or operating system.

Remediation

Upgrade nodemailer to version 10.1.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Uncontrolled Recursion in the addressparser function. An attacker can cause the process to terminate immediately by sending an email address header containing deeply nested groups, separated by many :s.

Remediation

Upgrade nodemailer to version 7.0.11 or higher.

References

• GitHub Commit
• Red Hat Bugzilla Bug

Overview

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Uncontrolled Recursion via _parseAddresses in src/mime-node/index.ts when a recipient field is supplied as a deeply nested array. The native array-to-string conversion applied before passing the value to addressparser recurses once per nesting level, so a recipient wrapped in roughly a few thousand arrays (approximately 10 KB of JSON) exhausts the call stack and causes a RangeError. Because the compile step of sendMail was not wrapped in a try/catch, the synchronous throw escapes the callback chain and can crash the process.

Note: This is only exploitable if the caller does not catch the complete synchronous invocation of sendMail.

Remediation

Upgrade nodemailer to version 10.0.2 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

engine.io is a realtime engine behind Socket.IO. It provides the foundation of a bidirectional connection between client and server

Affected versions of this package are vulnerable to Denial of Service (DoS). A malicious client could send a specially crafted HTTP request, triggering an uncaught exception and killing the Node.js process.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade engine.io to version 3.6.1, 6.2.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub PR

Overview

socket.io-parser is a socket.io protocol parser

Affected versions of this package are vulnerable to Denial of Service (DoS) due to insufficient validation when decoding a packet. An attacker can send an event with a name like '2[{"toString":"foo"}]' to trigger an uncaught exception and a crash, like the below.

TypeError: Cannot convert object to primitive value
       at Socket.emit (node:events:507:25)
       at .../node_modules/socket.io/lib/socket.js:531:14

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade socket.io-parser to version 3.4.3, 4.2.3 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Release

Overview

ws is a simple to use websocket client, server and console for node.js.

Affected versions of this package are vulnerable to Denial of Service (DoS) when the number of received headers exceed the server.maxHeadersCount or request.maxHeadersCount threshold.

Workaround

This issue can be mitigating by following these steps:

1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent.

2. Set server.maxHeadersCount to 0 so that no limit is applied.

PoC

const http = require('http');
const WebSocket = require('ws');

const server = http.createServer();

const wss = new WebSocket.Server({ server });

server.listen(function () {
  const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
  const headers = {};
  let count = 0;

  for (let i = 0; i < chars.length; i++) {
    if (count === 2000) break;

    for (let j = 0; j < chars.length; j++) {
      const key = chars[i] + chars[j];
      headers[key] = 'x';

      if (++count === 2000) break;
    }
  }

  headers.Connection = 'Upgrade';
  headers.Upgrade = 'websocket';
  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
  headers['Sec-WebSocket-Version'] = '13';

  const request = http.request({
    headers: headers,
    host: '127.0.0.1',
    port: server.address().port
  });

  request.end();
});

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade ws to version 5.2.4, 6.2.3, 7.5.10, 8.17.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Issue
• GitHub PR
• GitHub Release

Overview

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to CRLF Injection via the comment field in the list message option. An attacker can inject arbitrary headers into generated email messages by supplying crafted input containing CRLF sequences.

Remediation

Upgrade nodemailer to version 8.0.9 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

nodemailer is an Easy as cake e-mail sending from your Node.js applications

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the message-level raw option bypassing disableFileAccess and disableUrlAccess flags. An attacker can access arbitrary local files or perform server-side request forgery by supplying crafted input to the raw field, which bypasses intended access restrictions and results in sensitive data being sent to an attacker-controlled recipient.

Remediation

Upgrade nodemailer to version 9.0.1 or higher.

References

• GitHub Advisory
• GitHub Commit