fix(security): upgrade socket.io ecosystem to fix DoS vulns #33313

MuazOthman · 2026-01-30T18:09:48Z

This PR upgrades the socket.io ecosystem dependencies to address multiple Denial of Service (DoS) and related vulnerabilities.

Additional details

Upgrading these dependencies removes several known security vulnerabilities, primarily DoS, and resolves inconsistencies with new upstream package structures to maintain the security and stability of the project.

socket.io and socket.io-client upgraded from 4.0.1 to 4.7.0
- Fixes: CVE-2024-38355, CVE-2023-32695, CVE-2022-41940, CVE-2022-21676, CVE-2024-37890
socket.io-parser upgraded from 4.0.5 to 4.2.3
- Fixes: CVE-2023-32695
engine.io upgraded from 6.4.2 to 6.5.5
engine.io-client upgraded to 6.5.4
- Fixes: CVE-2024-37890
engine.io-parser upgraded from 4.0.2 to 5.2.2
- Fixes: CVE-2022-41940, CVE-2022-21676

Additional updates:

Rewrote patches to accommodate new file structure (build/cjs, esm, and esm-debug)
Ensured socket.io-parser is not hoisted and added it to Vitest's alias list
Updated root resolution for socket.io-parser to 4.2.3

Note

Medium Risk
Medium risk because it upgrades core websocket transport/parsing dependencies and rewrites patch-package patches, which can subtly change runtime socket behavior across browser/node environments.

Overview
Upgrades the Socket.IO stack to newer, security-fixed releases. @packages/socket now depends on socket.io/socket.io-client 4.7.0, engine.io 6.5.x, engine.io-parser 5.2.2, and socket.io-parser 4.2.3, with root package.json resolutions updated accordingly.

Reworks Cypress-specific patches for the new upstream file layout. The old engine.io-parser+4.0.2.patch and socket.io-parser+4.0.5.patch are replaced with build/cjs + esm + esm-debug patches to keep circular-object and binary handling (via flatted, cycle tracking, and broader binary detection).

Adjusts integration points for the upgraded libraries. CDPBrowserSocket switches from component-emitter to @socket.io/component-emitter typings, SocketBase.createSocketIo updates cookie option handling, tests/config are updated to import the new parser entrypoints and add a Vitest alias, and tooling/v8-snapshot metadata is refreshed to match the new dependency tree.

^{Written by Cursor Bugbot for commit d5ea767. This will update automatically on new commits. Configure here.}

PR Tasks

[na] Have tests been added/updated?
[na] Has a PR for user-facing changes been opened in cypress-documentation?
[na] Have API changes been updated in the type definitions?

- Bump socket.io and socket.io-client from 4.0.1 to 4.7.0 (CVE-2024-38355, CVE-2023-32695, CVE-2022-41940, CVE-2022-21676, CVE-2024-37890) - Bump socket.io-parser from 4.0.5 to 4.2.3 (CVE-2023-32695) - Bump engine.io from 6.4.2 to 6.5.5, engine.io-client to 6.5.4 (CVE-2024-37890) - Bump engine.io-parser from 4.0.2 to 5.2.2 (CVE-2022-41940, CVE-2022-21676) - Rewrite patches for new file structure (build/cjs + esm + esm-debug) - Make sure socket.io-parser is not hoisted and add it to vitest's alias list - Update root resolution for socket.io-parser to 4.2.3

cursor · 2026-01-30T18:20:34Z

packages/server/lib/socket-base.ts

-      cookie: {
-        name: cookie,
-      },
+      cookie: typeof cookie === 'string' ? { name: cookie as string } : undefined,


Redundant type assertion after type guard

Low Severity

The as string type assertion in { name: cookie as string } is redundant. TypeScript already narrows the type of cookie to string after the typeof cookie === 'string' check, making the explicit cast unnecessary.

cursor · 2026-01-30T18:32:49Z

packages/server/lib/socket-base.ts

-      cookie: {
-        name: cookie,
-      },
+      cookie: typeof cookie === 'string' ? { name: cookie as string } : undefined,


Cookie disable option not passed to socket.io

Medium Severity

The createSocketIo method's cookie parameter has type string | boolean, but the new conditional logic only handles the string case correctly. When cookie is false (intended to disable cookies), the code now returns undefined instead of false. According to socket.io's API, passing undefined uses default cookie settings (cookies enabled), while passing false disables cookies entirely. This behavioral change means users who set socketIoCookie: false to disable session cookies will now have cookies enabled with default settings.

cursor · 2026-01-30T18:32:49Z

packages/socket/lib/client/cdp-browser.ts

  }

-  // @ts-expect-error TODO: fix emit type
+  // @ts-ignore - override emit to send via CDP


Using @ts-ignore instead of @ts-expect-error

Low Severity

The change from @ts-expect-error to @ts-ignore is a degradation in type safety. @ts-expect-error is preferred because it will produce a compiler error when the underlying type issue is fixed, signaling that the directive can be removed. @ts-ignore silently suppresses errors indefinitely, making it easy to miss when workarounds become stale.

…'origin/develop' into muaz/upgrade-socketio

…rigin/develop' into muaz/upgrade-socketio

…'origin/develop' into muaz/upgrade-socketio

…rigin/develop' into muaz/upgrade-socketio

packages/socket/patches/engine.io-parser+5.2.2.patch

…'origin/develop' into muaz/upgrade-socketio

…rigin/develop' into muaz/upgrade-socketio

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-01-30T20:10:21Z

package.json

    "**/jquery": "3.7.1",
-    "**/qs": "6.14.1",
-    "**/socket.io-parser": "4.0.5",
+    "**/socket.io-parser": "4.2.3",


Removal of qs resolution allows vulnerable version installation

High Severity

The removal of the **/qs: 6.14.1 resolution allows [email protected] to be installed, which has a high-severity DoS vulnerability (CVE-2025-15284). The yarn.lock now shows packages like body-parser and express depending on [email protected] will get the vulnerable version instead of being forced to the patched 6.14.1. This is particularly concerning since the PR's stated purpose is to fix DoS vulnerabilities, yet it inadvertently introduces another DoS vulnerability through the qs package.

cypress · 2026-01-30T22:08:17Z

cypress Run #68759

Run Properties: Failed #68759 • d5ea767a93: Merge commit 'stash' into muaz/upgrade-socketio

Project	`cypress`
Branch Review	`muaz/upgrade-socketio`
Run status	`Failed #68759`
Run duration	`47m 22s`
Commit	`d5ea767a93: Merge commit 'stash' into muaz/upgrade-socketio`
Committer	`cypress-bot[bot]`
View all properties for this run ↗︎

Test results
Failures	`3`
Flaky	`7`
Pending	`343`
Skipped	`0`
Passing	`21702`
View all changes introduced in this branch ↗︎

Warning

Partial Report: The results for the Application Quality reports may be incomplete.

Warning

No Report: Something went wrong and we could not generate a report for the Application Quality products.

Tests for review

e2e/privileged_commands.cy.ts • 1 failed test • 5x-driver-firefox

View Output

Test Artifacts

privileged commands > in spec file or support file > handles ArrayBuffer arguments

    </td>
  </tr></table>

commands/net_stubbing.cy.ts • 2 failed tests • 5x-driver-firefox

View Output

Test Artifacts

... > can stub a response with an ArrayBuffer

    </td>
  </tr>
  <tr>
    <td colspan="2">
      <a href="https://cloud.cypress.io/projects/ypt4pf/runs/68759/overview/9db5a3e7-8da8-410a-99bc-4e459ba43ec3?reviewViewBy=FAILED&utm_source=github&utm_medium=failed&utm_campaign=view%20test">
        network stubbing > intercepting request > can modify an ArrayBuffer request body
      </a>
    </td>
    <td>
      
    </td>
  </tr></table>

commands/waiting.cy.js • 1 flaky test • 5x-driver-electron

View Output

Test		Artifacts
... > errors > does not throw again when 2nd alias doesn't reference a route		`Test Replay`

issues/28527.cy.ts • 1 flaky test • 5x-driver-electron

View Output

Test		Artifacts
issue 28527 > fails and then retries and verifies about:blank is not displayed		`Test Replay` `Screenshots`

commands/net_stubbing.cy.ts • 1 flaky test • 5x-driver-firefox

View Output

Test Artifacts

... > stops waiting when an xhr request is canceled

    </td>
  </tr></table>

commands/files.cy.js • 1 flaky test • 5x-driver-firefox

View Output

Test Artifacts

src/cy/commands/files > #readFile > retries assertions until they pass

    </td>
  </tr></table>

issues/28527.cy.ts • 1 flaky test • 5x-driver-firefox

View Output

Test		Artifacts
issue 28527 > fails and then retries and verifies about:blank is not displayed		`Screenshots`

The first 5 flaky specs are shown, see all 7 specs in Cypress Cloud.

MuazOthman changed the title ~~fix(socket): upgrade socket.io ecosystem to fix DoS vulns~~ fix(security): upgrade socket.io ecosystem to fix DoS vulns Jan 30, 2026

MuazOthman requested a review from jennifer-shehane January 30, 2026 18:11

cursor bot reviewed Jan 30, 2026

View reviewed changes

Merge remote-tracking branch 'origin/develop' into muaz/upgrade-socketio

549e0e5

cursor bot reviewed Jan 30, 2026

View reviewed changes

jennifer-shehane assigned MuazOthman Jan 30, 2026

cypress-bot[bot] added 5 commits January 30, 2026 19:40

index on muaz/upgrade-socketio: 549e0e5 Merge remote-tracking branch …

5941cad

…'origin/develop' into muaz/upgrade-socketio

WIP on muaz/upgrade-socketio: 549e0e5 Merge remote-tracking branch 'o…

8ce32e5

…rigin/develop' into muaz/upgrade-socketio

index on muaz/upgrade-socketio: 549e0e5 Merge remote-tracking branch …

2cfd6ce

…'origin/develop' into muaz/upgrade-socketio

WIP on muaz/upgrade-socketio: 549e0e5 Merge remote-tracking branch 'o…

caec6a2

…rigin/develop' into muaz/upgrade-socketio

Merge commit 'stash' into muaz/upgrade-socketio

2b72cf6

cursor bot reviewed Jan 30, 2026

View reviewed changes

packages/socket/patches/engine.io-parser+5.2.2.patch Show resolved Hide resolved

cypress-bot[bot] added 3 commits January 30, 2026 20:00

index on muaz/upgrade-socketio: 549e0e5 Merge remote-tracking branch …

dcece93

…'origin/develop' into muaz/upgrade-socketio

WIP on muaz/upgrade-socketio: 549e0e5 Merge remote-tracking branch 'o…

3bf2d39

…rigin/develop' into muaz/upgrade-socketio

Merge commit 'stash' into muaz/upgrade-socketio

d5ea767

cursor bot reviewed Jan 30, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(security): upgrade socket.io ecosystem to fix DoS vulns #33313

fix(security): upgrade socket.io ecosystem to fix DoS vulns #33313

Uh oh!

MuazOthman commented Jan 30, 2026 •

edited by cursor bot

Loading

Uh oh!

cursor bot Jan 30, 2026

Uh oh!

cursor bot Jan 30, 2026

Uh oh!

cursor bot Jan 30, 2026

Uh oh!

Uh oh!

cursor bot left a comment

Uh oh!

cursor bot Jan 30, 2026

Uh oh!

cypress bot commented Jan 30, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fix(security): upgrade socket.io ecosystem to fix DoS vulns #33313

Are you sure you want to change the base?

fix(security): upgrade socket.io ecosystem to fix DoS vulns #33313

Uh oh!

Conversation

MuazOthman commented Jan 30, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Additional details

PR Tasks

Uh oh!

cursor bot Jan 30, 2026

Choose a reason for hiding this comment

Redundant type assertion after type guard

Uh oh!

cursor bot Jan 30, 2026

Choose a reason for hiding this comment

Cookie disable option not passed to socket.io

Uh oh!

cursor bot Jan 30, 2026

Choose a reason for hiding this comment

Using @ts-ignore instead of @ts-expect-error

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Jan 30, 2026

Choose a reason for hiding this comment

Removal of qs resolution allows vulnerable version installation

Uh oh!

cypress bot commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

cypress Run #68759

Tests for review

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

MuazOthman commented Jan 30, 2026 •

edited by cursor bot

Loading

cypress bot commented Jan 30, 2026 •

edited

Loading