Socket.IO, a popular Node.js real-time framework, released version 4.7.4 on January 12, 2024, following version 4.7.3 released on January 3, 2024. Both versions maintain the same core dependencies crucial for establishing real-time communication, including cors, debug, accepts, base64id, engine.io, socket.io-parser, and socket.io-adapter. These dependencies ensure features like Cross-Origin Resource Sharing, debugging capabilities, content negotiation, unique ID generation, the underlying Engine.IO transport, message parsing, and adapter functionalities, respectively. The development dependencies, utilities utilized during the development process, also remain largely consistent, featuring tools for testing (mocha, expect.js, supertest, @types/mocha), code linting and formatting (prettier, typescript), and other build-related tasks (nyc, tsd, rimraf, ts-node, superagent, uWebSockets.js).
The key difference lies in the socket.io-client version specified as a dev dependency. Version 4.7.4 references socket.io-client":"4.7.4", suggesting it was tested with its corresponding client library. Version 4.7.3, references socket.io-client":"4.7.2". This minor version jump indicates possible bug fixes or enhancements in the client library that align with any server-side modifications within Socket.IO 4.7.4. The unpacked size also shows a marginal increase in the newer version. Developers should consider upgrading to 4.7.4 for the most current features, bug fixes, and client-server compatibility as part of their decision to keep libraries up to date. Specifically, ensure corresponding client-side dependencies like socket.io-client are upgraded when using Socket.IO v4.7.4.
All the vulnerabilities related to the version 4.7.4 of the package
cookie accepts cookie name, path, and domain with out of bounds characters
The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value.
A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie.
Upgrade to 0.7.0, which updates the validation for name, path, and domain.
Avoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.
