Skip to main content

Improper Check for Unusual or Exceptional Conditions

CVE-2023-37899

High
7.5/10

Summary

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like `const message = ${{ toString: '' }}` which would cause the NodeJS process to crash when sending an unexpected Socket.io message like `socket.emit('find', { toString: '' })`. This vulnerability affects packages "@feathersjs/transport-commons" and "@feathersjs/socketio" versions prior to 4.5.18 and 5.x prior to 5.0.8. Users are advised to upgrade. There is no known workaround for this vulnerability.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-754 - Improper Check for Unusual or Exceptional Conditions

The software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.

References

Advisory Timeline

  • Published