Description
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like `const message = ${{ toString: '' }}` which would cause the NodeJS process to crash when sending an unexpected Socket.io message like `socket.emit('find', { toString: '' })`. A fix has been released in versions 5.0.8 and 4.5.18. Users are advised to upgrade. There is no known workaround for this vulnerability.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
feathersjs feathers
< 4.5.18affected>= 5.0.0, < 5.0.8affected
References
- https://github.com/feathersjs/feathers/security/advisories/GHSA-hhr9-rh25-hvf9 ↗
- https://github.com/feathersjs/feathers/pull/3241 ↗
- https://github.com/feathersjs/feathers/pull/3242 ↗
- https://github.com/feathersjs/feathers/blob/crow/CHANGELOG.md#4518-2023-07-19 ↗
- https://github.com/feathersjs/feathers/blob/dove/CHANGELOG.md#508-2023-07-19 ↗