CVE-2024-38355: Insufficient Information (NVD-CWE-noinfo)
value: Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-19T20:15Z
Repository: https://github.com/socketio/socket.io
Language: TypeScript
Files changed: lib/socket.ts
Commit date: 2023-05-24 10:47:52 +0200
Commit message: refactor: add a noop handler for the error event

We should reduce the scope of the "event" error in the next major
version, as it is overloaded today:

- it can be sent by the client (`socket.emit("error")`, which is a perfectly valid event name)
- it can be emitted when the connection encounters an error (an invalid packet for example)
- it can be emitted when a packet is rejected in a middleware (`socket.use()`)

Related: https://github.com/socketio/socket.io/issues/2047

Diff: diff --git a/lib/socket.ts b/lib/socket.ts
index 416ca8a..fa6333e 100644
--- a/lib/socket.ts
+++ b/lib/socket.ts
@@ -278,10 +278,13 @@ export class Socket<
       if (this.server._opts.connectionStateRecovery) {
         this.pid = base64id.generateId();
       }
     }
     this.handshake = this.buildHandshake(auth);
+
+    // prevents crash when the socket receives an "error" event without listener
+    this.on("error", noop);
   }
 
   /**
    * Builds the `handshake` BC object
    *
@@ -718,16 +721,15 @@ export class Socket<
    * Handles a client error.
    *
    * @private
    */
   _onerror(err: Error): void {
-    if (this.listeners("error").length) {
-      this.emitReserved("error", err);
-    } else {
-      console.error("Missing error handler on `socket`.");
-      console.error(err.stack);
-    }
+    // FIXME the meaning of the "error" event is overloaded:
+    //  - it can be sent by the client (`socket.emit("error")`)
+    //  - it can be emitted when the connection encounters an error (an invalid packet for example)
+    //  - it can be emitted when a packet is rejected in a middleware (`socket.use()`)
+    this.emitReserved("error", err);
   }
 
   /**
    * Called upon closing. Called by `Client`.
    *

Vulnerable code:     if (this.listeners("error").length) {
      this.emitReserved("error", err);
    } else {
      console.error("Missing error handler on `socket`.");
      console.error(err.stack);
    }
Fixed code: 
    // prevents crash when the socket receives an "error" event without listener
    this.on("error", noop);
    // FIXME the meaning of the "error" event is overloaded:
    //  - it can be sent by the client (`socket.emit("error")`)
    //  - it can be emitted when the connection encounters an error (an invalid packet for example)
    //  - it can be emitted when a packet is rejected in a middleware (`socket.use()`)
    this.emitReserved("error", err);