CVE-2023-37899 feathersjs socket handler allows abusing implicit toString
An attacker can crash the Node.js process by sending a crafted Socket.io message with an invalid toString property, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-37899?
CVE-2023-37899 is a high-severity denial of service vulnerability in feathersjs feathers, published on 19 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like `const message = ${{ toString: '' }}` which would cause the NodeJS process to crash when sending an unexpected Socket.io message like `socket.emit('find', { toString: '' })`. A fix has been released in versions 5.0.8 and 4.5.18. Users are advised to upgrade. There is no known workaround for this vulnerability.
Weakness: CWE-754
Which versions are affected by CVE-2023-37899?
8 open source packages ship an affected version, including @feathersjs/socketio and @feathersjs/transport-commons. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@feathersjs/socketio npm | All versions | 4.5.18 |
@feathersjs/socketio npm | All versions | 4.5.18 |
@feathersjs/socketio npm | From 5.0.0 | 5.0.8 |
@feathersjs/socketio npm | From 5.0.0 | 5.0.8 |
@feathersjs/transport-commons npm | All versions | 4.5.18 |
@feathersjs/transport-commons npm | All versions | 4.5.18 |
2 more packages
@feathersjs/transport-commons npm | From 5.0.0 | 5.0.8 |
@feathersjs/transport-commons npm | From 5.0.0 | 5.0.8 |
Products include Feathersjs Feathers.
How do I fix CVE-2023-37899?
Upgrade @feathersjs/socketio to a fixed version for your release line: 4.5.18 or 5.0.8.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-37899 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-37899 exists.
Other vulnerabilities in feathersjs feathers
- CVE-2026-29792 Feathersjs has an OAuth Callback Account Takeover
- CVE-2026-29793 NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
- CVE-2026-27193 Feathers exposes internal headers via unencrypted session cookie
- CVE-2026-27192 Feathers has an origin validation bypass via prefix matching
- CVE-2026-27191 Feathers: Open Redirect in OAuth callback enables account takeover
Sources
Also known as GHSA-hhr9-rh25-hvf9.