chore(deps): update dependency socket.io-parser to v4.2.7 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
socket.io-parser (source)	4.0.5 → 4.2.7

---

Insufficient validation when decoding a Socket.IO packet

CVE-2023-32695 / GHSA-cqmj-92xf-r6r9

More information

Details

Impact

A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.

TypeError: Cannot convert object to primitive value
       at Socket.emit (node:events:507:25)
       at .../node_modules/socket.io/lib/socket.js:531:14

Patches

A fix has been released today (2023/05/22):

• socketio/socket.io-parser@3b78117, included in socket.io-parser@4.2.3
• socketio/socket.io-parser@2dc3c92, included in socket.io-parser@3.4.3

Another fix has been released for the 3.3.x branch:

• socketio/socket.io-parser@ee00660, included in `socket.io-parser@3.3.4

socket.io version	socket.io-parser version	Needs minor update?
4.5.2...latest	~4.2.0 (ref)	npm audit fix should be sufficient
4.1.3...4.5.1	~4.1.1 (ref)	Please upgrade to socket.io@4.6.x
3.0.5...4.1.2	~4.0.3 (ref)	Please upgrade to socket.io@4.6.x
3.0.0...3.0.4	~4.0.1 (ref)	Please upgrade to socket.io@4.6.x
2.3.0...2.5.0	~3.4.0 (ref)	npm audit fix should be sufficient

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

• Open a discussion here

Thanks to @​rafax00 for the responsible disclosure.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9
• https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced
• https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3
• https://github.com/socketio/socket.io-parser/commit/1c220ddbf45ea4b44bc8dbf6f9ae245f672ba1b9
• https://nvd.nist.gov/vuln/detail/CVE-2023-32695
• https://github.com/socketio/socket.io-parser/releases/tag/4.2.3
• https://github.com/socketio/socket.io-parser/commit/ee006607495eca4ec7262ad080dd3a91439a5ba4
• https://github.com/advisories/GHSA-cqmj-92xf-r6r9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

socket.io allows an unbounded number of binary attachments

CVE-2026-33151 / GHSA-677m-j7p3-52f9

More information

Details

Impact

A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.

Patches

Version range	Used by	Fixed version
>=4.0.0 <4.2.6	socket.io@4.x and socket.io-client@4.x	4.2.6
>=3.4.0 <3.4.4	socket.io@2.x	3.4.4
<3.3.5	socket.io-client@2.x	3.3.5

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

• Open a discussion here

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9
• https://github.com/socketio/socket.io/commit/719f9ebab0772ffb882bd614b387e585c1aa75d4
• https://github.com/socketio/socket.io/commit/9d39f1f080510f036782f2177fac701cc041faaf
• https://github.com/socketio/socket.io/commit/b25738c416c4e32fbff62ee182afa8f6d0dacf78
• https://nvd.nist.gov/vuln/detail/CVE-2026-33151
• https://github.com/advisories/GHSA-677m-j7p3-52f9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Socket.IO: Zero-attachment Memory Exhaustion

CVE-2026-69185 / GHSA-2m8v-j782-fhvr

More information

Details

Impact

A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.

Patches

Version range	Used by	Fixed version
>=4.0.0 <4.2.7	socket.io@4.x and socket.io-client@4.x	4.2.7
>=3.4.0 <3.4.5	socket.io@2.x	3.4.5
<3.3.6	socket.io-client@2.x	3.3.6

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

• Open a discussion here

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr
• https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4
• https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240
• https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291
• https://github.com/advisories/GHSA-2m8v-j782-fhvr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

socketio/socket.io (socket.io-parser)

v4.2.7

Compare Source

Bug Fixes

• honor toJSON() when deconstructing a binary packet (#​5518) (57f1114)
• reject binary packets with zero attachments (7c6ef57)

New Contributors

• @​spokodev made their first contribution in #​5518

v4.2.6

Compare Source

This release includes a fix for CVE-2026-33151. Please upgrade as soon as possible.

Bug Fixes

• add a limit to the number of binary attachments (b25738c)

v4.2.5

Compare Source

This release contains a bump of debug from ~4.3.1 to ~4.4.1.

v4.2.4

Compare Source

v4.2.3

Compare Source

v4.2.2

Compare Source

v4.2.1

Compare Source

v4.2.0

Compare Source

Bug Fixes

• typings: allow async listener in typed events (ccfd8ca)

Features

• ignore the query string when serving client JavaScript (#​4024) (24fee27)

Links:

• Diff: socketio/socket.io@4.1.3...4.2.0
• Client release: 4.2.0
• engine.io version: ~5.2.0
• ws version: ~7.4.2

v4.1.2

Compare Source

Bug Fixes

• typings: ensure compatibility with TypeScript 3.x (0cb6ac9)
• ensure compatibility with previous versions of the adapter (a2cf248)

Links:

• Diff: socketio/socket.io@4.1.1...4.1.2
• Client release: 4.1.2
• engine.io version: ~5.1.0
• ws version: ~7.4.2

v4.1.1

Compare Source

Bug Fixes

• typings: properly type server-side events (b84ed1e)
• typings: properly type the adapter attribute (891b187)

Links:

• Diff: socketio/socket.io@4.1.0...4.1.1
• Client release: 4.1.1
• engine.io version: ~5.1.0
• ws version: ~7.4.2

v4.1.0

Compare Source

Blog post: https://socket.io/blog/socket-io-4-1-0/

Features

• add support for inter-server communication (93cce05)
• notify upon namespace creation (499c892)
• add a "connection_error" event (7096e98, from engine.io)
• add the "initial_headers" and "headers" events (2527543, from engine.io)

Links:

• Diff: socketio/socket.io@4.0.2...4.1.0
• Client release: 4.1.0
• engine.io version: ~5.1.0
• ws version: ~7.4.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @material-ui/core@4.9.14
npm error Found: react@17.0.2
npm error node_modules/react
npm error   react@"17.0.2" from the root project
npm error   peer react@"17.0.2" from @hot-loader/react-dom@17.0.2
npm error   node_modules/@hot-loader/react-dom
npm error     dev @hot-loader/react-dom@"17.0.2" from the root project
npm error   11 more (@testing-library/react, gatsby, gatsby-link, ...)
npm error
npm error Could not resolve dependency:
npm error peer react@"^16.8.0" from @material-ui/core@4.9.14
npm error node_modules/@material-ui/core
npm error   @material-ui/core@"4.9.14" from the root project
npm error   peer @material-ui/core@"^4.0.0" from @material-ui/icons@4.9.1
npm error   node_modules/@material-ui/icons
npm error     @material-ui/icons@"4.9.1" from the root project
npm error   1 more (@material-ui/lab)
npm error
npm error Conflicting peer dependency: react@16.14.0
npm error node_modules/react
npm error   peer react@"^16.8.0" from @material-ui/core@4.9.14
npm error   node_modules/@material-ui/core
npm error     @material-ui/core@"4.9.14" from the root project
npm error     peer @material-ui/core@"^4.0.0" from @material-ui/icons@4.9.1
npm error     node_modules/@material-ui/icons
npm error       @material-ui/icons@"4.9.1" from the root project
npm error     1 more (@material-ui/lab)
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-09-03T01_06_28_094Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-03T01_06_28_094Z-debug-0.log