Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

sockjs/sockjs-node

              main @ 51e860a
            

Fixes

CVEs

MEDIUM

Peak severity

Highlights

Cross-Origin Resource Sharing (CORS) Violation: 1 prior fix. Scrutinize any change in this area.

src/trans-eventsource.coffee: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: A race condition in the WebSocket heartbeat timeout callback can trigger a null-pointer dereference and crash the application if the session has already been cleaned up. This is exacerbated by incorrect handling of the Upgrade header as highlighted in CVE-2020-7693.

Cross-Origin Resource Sharing (CORS) Violation: Misconfiguration of CORS headers allowed credentials to be sent when the origin was set to a wildcard (*), exposing sensitive cross-origin data to unauthorized sites.

XSS: Lack of strict content-type options and response prefixing allowed SWF-based JSONP exploits (Rosetta Flash), enabling attackers to execute arbitrary scripts via the JSONP endpoint.