CVE-2023-30591

Summary

CVE-2023-30591 is a denial-of-service vulnerability affecting NodeBB versions prior to 2.8.11. Unauthenticated attackers can trigger a crash in NodeBB by sending crafted Socket.IO messages containing array or object type event names, specifically exploiting the `eventName.startsWith()` or `eventName.toString()` functions during message processing. This issue allows attackers to cause NodeBB to crash, leading to a denial-of-service condition.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.