From 9d5e0512ff0ddceab3c46220d1eed1320da569d0 Mon Sep 17 00:00:00 2001
From: Nikita Pivkin <nikita.pivkin@smartforce.io>
Date: Sat, 19 Sep 2026 20:51:05 +0600
Subject: [PATCH] Improve GHSA-25hc-qcg6-38wj

---
 .../2024/06/GHSA-25hc-qcg6-38wj/GHSA-25hc-qcg6-38wj.json | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/advisories/github-reviewed/2024/06/GHSA-25hc-qcg6-38wj/GHSA-25hc-qcg6-38wj.json b/advisories/github-reviewed/2024/06/GHSA-25hc-qcg6-38wj/GHSA-25hc-qcg6-38wj.json
index 1fbf32d7dd03..440d0c5b2854 100644
--- a/advisories/github-reviewed/2024/06/GHSA-25hc-qcg6-38wj/GHSA-25hc-qcg6-38wj.json
+++ b/advisories/github-reviewed/2024/06/GHSA-25hc-qcg6-38wj/GHSA-25hc-qcg6-38wj.json
@@ -9,10 +9,6 @@
   "summary": "socket.io has an unhandled 'error' event",
   "details": "### Impact\n\nA specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.\n\n```\nnode:events:502\n    throw err; // Unhandled 'error' event\n    ^\n\nError [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)\n    at new NodeError (node:internal/errors:405:5)\n    at Socket.emit (node:events:500:17)\n    at /myapp/node_modules/socket.io/lib/socket.js:531:14\n    at process.processTicksAndRejections (node:internal/process/task_queues:77:11) {\n  code: 'ERR_UNHANDLED_ERROR',\n  context: undefined\n}\n```\n\n### Affected versions\n\n| Version range    | Needs minor update?                            |\n|------------------|------------------------------------------------|\n| `4.6.2...latest` | Nothing to do               |\n| `3.0.0...4.6.1`  | Please upgrade to `socket.io@4.6.2` (at least) |\n| `2.3.0...2.5.0`  | Please upgrade to `socket.io@2.5.1`            |\n\n### Patches\n\nThis issue is fixed by https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115, included in `socket.io@4.6.2` (released in May 2023).\n\nThe fix was backported in the 2.x branch today: https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c\n\n### Workarounds\n\nAs a workaround for the affected versions of the `socket.io` package, you can attach a listener for the \"error\" event:\n\n```js\nio.on(\"connection\", (socket) => {\n  socket.on(\"error\", () => {\n    // ...\n  });\n});\n```\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open a discussion [here](https://github.com/socketio/socket.io/discussions)\n\nThanks a lot to [Paul Taylor](https://github.com/Y0ursTruly) for the responsible disclosure.\n\n### References\n\n- https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115\n- https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c\n",
   "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
-    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
@@ -36,10 +32,7 @@
             }
           ]
         }
-      ],
-      "database_specific": {
-        "last_known_affected_version_range": "< 2.5.0"
-      }
+      ]
     },
     {
       "package": {