CVE-2022-2421: Socket Socket.io-Parser

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.

Affected products

• Socket Socket.io-Parser: before 3.3.3 (fixed in 3.3.3); from 3.4.0, before 3.4.2 (fixed in 3.4.2); from 4.0.0, before 4.0.5 (fixed in 4.0.5); from 4.1.0, before 4.2.1 (fixed in 4.2.1)

Published 2022-10-26. Last modified 2026-06-17.