CVE-2023-30591: Nodebb

High severity, CVSS 7.5. EPSS: 58.7% chance of exploitation in the next 30 days.

Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively.

Affected products

• Nodebb Nodebb: up to and including 2.8.10

Published 2023-09-29. Last modified 2026-06-17.