PatchTheCVEsockjs vulnerabilities and fixes
Recent CVEs affecting sockjs, with upgrade or downgrade steps. 2 tracked.
sockjs has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2020-07-09. Highest priority: CVE-2020-7693 (score 52/100).
- CVE-2020-8823 MEDIUM 6.1 UPGRADE htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile
- CVE-2020-7693 MEDIUM 5.3 UPGRADE Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs a
FAQ
How do I fix sockjs vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is sockjs being exploited right now?
None of the tracked sockjs CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which sockjs CVE should I patch first?
CVE-2020-7693 currently ranks highest (52/100): Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs a.