socket.io-parser

socket.io protocol parser

Latest 4.2.7

NPM

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Repo bus factor

All 32 recent commits came from one contributor, creating a real continuity risk despite the repository being organization-owned.

Repo package mention

The repository name differs from the package name, which is ordinary for a monorepo, but its README does not mention socket.io-parser; that leaves some uncertainty about the package-to-repository linkage.

Workflow audit

All 14 workflows were analyzed with no untrusted checkout or script-injection paths, and permissions are read-only or job-scoped. However, all 28 action references are unpinned, and the low-confidence cache-poisoning finding is a minor hygiene concern.

Vulnerabilities

Title	Versions	Severity
CVE-2026-69185 socket.io-parser is vulnerable to Improper Input Validation in versions 4.0.0 - 4.2.7, 3.4.0 - 3.4.5 and 0.0.0 - 3.3.6.	0.0.0 - 3.3.63.4.0 - 3.4.54.0.0 - 4.2.7	High
CVE-2026-33151 socket.io-parser is vulnerable to Improper Check for Unusual or Exceptional Conditions in versions 0.0.0 - 3.3.5, 3.4.0 - 3.4.4 and 4.0.0 - 4.2.6.	0.0.0 - 3.3.53.4.0 - 3.4.44.0.0 - 4.2.6	High
CVE-2023-32695 socket.io-parser is vulnerable to Improper Input Validation in versions 3.4.0 - 3.4.3, 4.0.4 - 4.2.3 and 0.0.0 - 3.3.4.	0.0.0 - 3.3.43.4.0 - 3.4.34.0.4 - 4.2.3	High
CVE-2022-2421 socket.io-parser is vulnerable to Improper Input Validation in versions 4.1.0 - 4.2.1, 4.0.0 - 4.0.5, 0.0.0 - 3.3.3 and 3.4.0 - 3.4.2.	0.0.0 - 3.3.33.4.0 - 3.4.24.0.0 - 4.0.5 +1 more	Critical
CVE-2020-36049 socket.io-parser is vulnerable to Uncontrolled Resource Consumption in versions 0.0.0 - 3.3.2 and 3.4.0 - 3.4.0.	0.0.0 - 3.3.23.4.0 - 3.4.0	High