feathersjs socket handler allows abusing implicit toString
CVE-2023-37899
7.5HIGH
What is CVE-2023-37899?
The Feathersjs framework, utilized for building web APIs and real-time applications, has a vulnerability due to its socket handler failing to handle invalid string conversion errors. This oversight can lead to unprecedented crashes of the NodeJS process when erroneous Socket.io messages are emitted. Affected versions, specifically prior to 5.0.8 and 4.5.18, require immediate attention and upgrading as no workaround exists for this flaw. To protect system integrity and functionality, users should update to the patched versions.
Affected Version(s)
feathers < 4.5.18 < 4.5.18
feathers >= 5.0.0, < 5.0.8 < 5.0.0, 5.0.8