GitHub Advisoryadvisory · npm

GHSA-gpw9-fwm8-7rx7 DoS vulnerability for apps with sockets enabled

HIGH Published 2023-07-27 Modified 2023-07-27 Official page ↗
Aliases
CVE-2023-38504
Ecosystem
npm
Packages
sails
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-248
Reviewed
2023-07-27

Affected packages

• npm sails: < 1.5.7 → fixed in 1.5.7

Description

Impact In Sails apps <=v1.5.6, an attacker can send a virtual request that will cause the node process to crash. Patches This behavior was fixed in Sails v1.5.7 Workarounds Disable the sockets hook and remove the `sails.io.js` client References https://github.com/balderdashy/sails/pull/7287 Big thanks to @ThomasRinsma at Codean!

Related

Alias · CVE (1)

  • CVE-2023-38504 Sails is a realtime MVC Framework for Node.js. vulnerability

Weakness · CWE (1)

  • CWE-248 Uncaught Exception weakness

References