CVE-2023-30591: NodeBB Pre-Authentication Denial-of-Service
Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking eventName.startsWith() or eventName.toString(), while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this denial-of-service vulnerability in NodeBB?
The vulnerability ID for this denial-of-service vulnerability in NodeBB is CVE-2023-30591.
What is the severity of CVE-2023-30591?
The severity of CVE-2023-30591 is high with a severity value of 7.5.
How does this vulnerability in NodeBB allow attackers to trigger a crash?
This vulnerability in NodeBB allows unauthenticated attackers to trigger a crash by exploiting the `eventName.startsWith()` or `eventName.toString()` functions in the processing of crafted Socket.IO messages.
Which version of NodeBB is affected by CVE-2023-30591?
NodeBB version up to and including v2.8.10 is affected by CVE-2023-30591.
How can this denial-of-service vulnerability in NodeBB be fixed?
To fix this denial-of-service vulnerability in NodeBB, it is recommended to update to a version higher than v2.8.10 that includes the necessary security patches.