StackPrism

npm package

socket.io-parser vulnerabilities by version

The latest release, 4.2.7 (Jul 15, 2026), has no known vulnerabilities. 54% of last week’s 29.7M downloads went to versions with known vulnerabilities. OSV.dev lists 5 advisories for socket.io-parser; the newest was published on Aug 3, 2026.

npm (opens in a new tab) describes it as “socket.io protocol parser”

Latest release
4.2.7
Jul 15, 2026, no known vulnerabilities
Downloads last week
29.7M
All versions, from npm
Advisories on OSV.dev
5
Newest Aug 3, 2026
Licence
MIT
OpenSSF Scorecard
6.5/10
socketio/socket.io (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
4.2.7latestJul 15, 2026No known vulnerabilities13.2M
4.2.6Mar 17, 20261 known vulnerability, worst rated critical7.2M
4.2.4May 31, 20232 known vulnerabilities, worst rated critical3.8M
4.2.5Dec 23, 20252 known vulnerabilities, worst rated critical2.9M
3.2.0Feb 28, 20185 known vulnerabilities, worst rated critical239.3K
3.3.6Jul 16, 2026No known vulnerabilities223.9K
2.3.1Oct 24, 20165 known vulnerabilities, worst rated critical221.2K
3.4.1May 13, 20204 known vulnerabilities, worst rated critical178.7K

Who is still on a vulnerable socket.io-parser

54% of last week’s 29.7M socket.io-parser downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. socket.io-parser doesn’t publish support dates we can check.

LineNewest releaseReleased
44.2.7Jul 15, 2026
33.4.5Jul 15, 2026
22.3.2Dec 30, 2016
11.1.2Feb 11, 2014

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. CriticalCVE-2026-69185 on OSV.dev (opens in a new tab)GHSA-2m8v-j782-fhvr

    Socket.IO: Zero-attachment Memory Exhaustion

    Affects >= 4.0.0, < 4.2.7; >= 3.4.0, < 3.4.5; < 3.3.6. Published Aug 3, 2026.

  2. CriticalCVE-2026-33151 on OSV.dev (opens in a new tab)GHSA-677m-j7p3-52f9

    socket.io allows an unbounded number of binary attachments

    Affects < 3.3.5; >= 3.4.0, < 3.4.4; >= 4.0.0, < 4.2.6. Published Mar 18, 2026.

  3. WarningCVE-2023-32695 on OSV.dev (opens in a new tab)GHSA-cqmj-92xf-r6r9

    Insufficient validation when decoding a Socket.IO packet

    Affects >= 4.0.4, < 4.2.3; >= 3.4.0, < 3.4.3; < 3.3.4. Published May 23, 2023.

  4. CriticalCVE-2022-2421 on OSV.dev (opens in a new tab)GHSA-qm95-pgcg-qqfq

    Insufficient validation when decoding a Socket.IO packet

    Affects >= 4.0.0, < 4.0.5; >= 4.1.0, < 4.2.1; < 3.3.3; >= 3.4.0, < 3.4.2. Published Oct 26, 2022.

  5. CriticalCVE-2020-36049 on OSV.dev (opens in a new tab)GHSA-xfhh-g9f5-x4m4

    Resource exhaustion in socket.io-parser

    Affects < 3.3.2; >= 3.4.0, < 3.4.1. Published Jun 30, 2021.

Which socket.io-parser do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for socket.io-parser, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.