GHSA-hhr9-rh25-hvf9 Feathers socket handler allows abusing implicit toString

• npm @feathersjs/socketio: < 4.5.18 → fixed in 4.5.18 • npm @feathersjs/socketio: >= 5.0.0, < 5.0.8 → fixed in 5.0.8 • npm @feathersjs/transport-commons: < 4.5.18 → fixed in 4.5.18 • npm @feathersjs/transport-commons: >= 5.0.0, < 5.0.8 → fixed in 5.0.8

Impact Feathers socket handler did not catch invalid string conversion errors like: ```ts const message = `${{ toString: '' }}` ``` Causing the NodeJS process to crash when sending an unexpected Socket.io message like ```ts socket.emit('find', { toString: '' }) ``` Patches A fix has been released in • `v5.0.8` via #3241 • `v4.5.18` via #3242 Workarounds Since it is in the core Socket handling code upgrading to the latest version is necessary. References • v5.0.8 Changelog • v4.5.18 Changelog