Repository navigation
[socket.io-parser] Unflagged breaking change in patch version 4.2.6 #5489
Description
Describe the bug
When upgrading socket.io-parser from 4.2.* to 4.2.6, the introduction of the limit to the number of binary attachments with a default of 10 will break existing use cases that relied on more than 10 attachments, as parsing will now fail.
Looks like this would also affect upgrading patch versions to 3.4.4 and 3.3.5 (where the fix also seems to have been applied).
Additional context
I appreciate this isn't really a bug in and of itself, and I'm omitting any reproduction information - perhaps it would be better raised as a discussion.
However, I wanted to highlight this issue somewhere, as we accepted this innocuous-looking patch version from an automated security upgrade, and later found it broke our application in specific cases. It probably needs flagging as a breaking change.
Activity
darrachequesne commentedon Apr 8, 2026
Hi!
Sorry for the inconvenience. This limit was implemented to fix a vulnerability (CVE-2026-33151) that could be exploited to overwhelm the server's memory. We believed that a limit of 10 binary attachments would be sufficient in most cases.
Reference: GHSA-677m-j7p3-52f9
michaelowolf commentedon Apr 8, 2026
Hi, no apology needed at all - I understand the need for the change. I just felt it was important to raise with you, as others might encounter the same breaking change. Thanks for the response!
darrachequesne commentedon Apr 10, 2026
Thanks. I will pin the issue as other users might indeed be interested.