CVE-2020-28481: Socket Socket.io

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

Affected products

• Socket Socket.io: before 2.4.0 (fixed in 2.4.0)

Published 2021-01-19. Last modified 2026-06-17.