Improper Check for Unusual or Exceptional Conditions Affecting @feathersjs/transport-commons package, versions <4.5.18 >=5.0.0 <5.0.8


Severity

Recommended
0.0
high
0
10

    Threat Intelligence

    EPSS
    0.06% (24th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-FEATHERSJSTRANSPORTCOMMONS-5794669
  • published 20 Jul 2023
  • disclosed 20 Jul 2023
  • credit CodeanIO

How to fix?

Upgrade @feathersjs/transport-commons to version 4.5.18, 5.0.8 or higher.

Overview

@feathersjs/transport-commons is a Shared functionality for websocket providers

Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions due to not catching invalid string conversion errors like const message = ${{ toString: '' }} which would cause the NodeJS process to crash when sending an unexpected Socket.io message like socket.emit('find', { toString: '' }).

CVSS Scores

version 3.1
Expand this section

Snyk

7.5 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    None
  • Integrity (I)
    None
  • Availability (A)
    High
Expand this section

NVD

7.5 high