Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2017-16031

Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtaining sensitive information.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2017-16031
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 09:52 UTC · Revision 1

Source evidence

CVE-2017-16031

core-osv · Original source

Published 4 Jun 2018, 19:29 UTC

Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtaining sensitive information.

osv:CVE-2017-16031
Complete source record
{
  "id": "e813d10273ecddcf9925d6646c6880571a4003259fdf0aad1a25984cbdd52bf0",
  "url": "https://osv.dev/vulnerability/CVE-2017-16031",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2017-16031",
    "summary": "Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtaining sensitive information.",
    "evidence": "osv:CVE-2017-16031",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2017-16031",
      "aliases": [
        "CVE-2017-16031",
        "GHSA-qv2v-m59f-v5fw"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/socketio/socket.io",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "67b4eb9abdf111dfa9be4176d1709374a2b4ded8"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "fixed": "67b4eb9abdf111dfa9be4176d1709374a2b4ded8"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "0.9.5",
            "0.9.4",
            "0.9.3",
            "0.9.2",
            "0.9.1-1",
            "0.9.1",
            "0.9.0",
            "0.8.7",
            "0.8.6",
            "0.8.5",
            "0.8.4",
            "0.8.3",
            "0.8.2",
            "0.8.1",
            "0.8.0",
            "0.7.9",
            "0.7.8",
            "0.7.7",
            "0.7.6",
            "0.7.5",
            "0.7.4",
            "0.7.3",
            "0.7.2",
            "0.7.1",
            "0.7.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-16031.json"
          }
        }
      ],
      "modified": "2026-10-20T10:48:16.171658948Z",
      "provider": "osv",
      "references": [
        "https://nodesecurity.io/advisories/321",
        "https://github.com/socketio/socket.io/issues/856",
        "https://github.com/socketio/socket.io/pull/857",
        "https://github.com/socketio/socket.io/commit/67b4eb9abdf111dfa9be4176d1709374a2b4ded8"
      ],
      "provider_metadata": {
        "unresolved_ranges": [
          {
            "cpes": [
              "cpe:2.3:a:socket:socket.io:*:*:*:*:*:node.js:*:*"
            ],
            "vendor_product": "socket:socket.io",
            "extracted_events": [
              {
                "range": [
                  {
                    "last_affected": "0.9.6"
                  }
                ],
                "source": "CPE_RANGE"
              }
            ]
          },
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "last_affected": "0.9.6"
                  }
                ],
                "source": "DESCRIPTION"
              }
            ]
          }
        ]
      }
    },
    "related_cves": [
      {
        "value": "CVE-2017-16031",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 380214,
  "published_at": "2018-06-04T19:29:01.727+00:00"
}