high7.5
CVE-2023-38504
DoS vulnerability for apps with sockets enabled
Impact
### Impact In Sails apps <=v1.5.6, an attacker can send a virtual request that will cause the node process to crash. ### Patches This behavior was fixed in Sails [v1.5.7](https://github.com/balderdashy/sails/releases/tag/v1.5.7) ### Workarounds Disable the sockets hook and remove the `sails.io.js` client ### References https://github.com/balderdashy/sails/pull/7287 Big thanks to @ThomasRinsma at [Codean](https://www.linkedin.com/company/codeanio/)!
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | sails | < 1.5.7 | 1.5.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sailsjs | Sails | before 1.5.7 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/balderdashy/sails/commit/4a023dc5095a4b30fdc8535f705ed34cd22d2f7d
- https://github.com/balderdashy/sails/pull/7287
- https://github.com/balderdashy/sails/releases/tag/v1.5.7
- https://github.com/balderdashy/sails/security/advisories/GHSA-gpw9-fwm8-7rx7
- https://github.com/advisories/GHSA-gpw9-fwm8-7rx7
- https://nvd.nist.gov/vuln/detail/CVE-2023-38504