Vulnerability record · CVE-2023-30591 · published 29 September 2023
CVE-2023-30591: NodeBB Socket.IO event name type confusion denial of service
Nodebb · Nodebb
NodeBB versions up to and including v2.8.10 crash when processing crafted Socket.IO messages whose event name is an array or object instead of a string. The code calls eventName.startsWith() or eventName.toString() on the malformed value, causing an unhandled error that takes down the process. Because the trigger is unauthenticated, any network-reachable instance is exposed to repeated availability loss.
Description
Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityUnauthenticated remote crash with a high EPSS score and public patch commits, though no confirmed in-the-wild exploitation or KEV listing.
What it is
NodeBB versions up to and including v2.8.10 crash when processing crafted Socket.IO messages whose event name is an array or object instead of a string. The code calls eventName.startsWith() or eventName.toString() on the malformed value, causing an unhandled error that takes down the process. Because the trigger is unauthenticated, any network-reachable instance is exposed to repeated availability loss.
Impact
An attacker can crash the NodeBB server process, denying forum service to all users. Repeated requests can keep the service down; there is no evidence of data access or code execution.
Attack surface
Reachable over the network through the Socket.IO endpoint; the CVSS vector shows no privileges and no user interaction required. Any client that can open a Socket.IO connection can send the malformed event name.
Exploitation
Not listed in CISA KEV and no public exploit tag is present, but EPSS is 0.53804 (98.9th percentile), indicating a high modeled likelihood of exploitation activity. Patch commits are public, which lowers the effort to reproduce.
What to do
- Upgrade NodeBB to a version containing the three patch commits (37b48b82, 4d2d7689, 830f142b) or later; this is the primary fix.
- If immediate upgrade is not possible, restrict network access to the Socket.IO endpoint to trusted clients and place the forum behind a reverse proxy or WAF that can reject malformed Socket.IO frames.
- Run NodeBB under a process supervisor that restarts on crash, and alert on restart events to limit downtime.
- Monitor the NodeBB repository and StarLabs advisory for updated guidance and any backported fixes.
Detection
- Alert on NodeBB process crashes or unexpected restarts, especially clustered in time.
- Inspect reverse proxy or Socket.IO logs for event names that are arrays or objects rather than strings.
- Baseline normal Socket.IO event names and flag deviations, particularly from unauthenticated connections.
- Correlate repeated connection attempts from a single source with subsequent service restarts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-30591 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-30591), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
