Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.

Affected: npm: socket.io-parser

Due to improper type validation in the `socket.io-parser` library (which is used by the `socket.io` and `socket.io-client` packages to encode and decode Socket.IO packets), it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.

Example:

```js const decoder = new Decoder();

decoder.on("decoded", (packet) => { console.log(packet.data); // prints [ 'hello', [Function: splice] ] })

decoder.add('51-["hello",{"_placeholder":true,"num":"splice"}]'); decoder.add(Buffer.from("world")); ```

This bubbles up in the `socket.io` package:

```js io.on("connection", (socket) => { socket.on("hello", (val) => { // here, "val" could be a function instead of a buffer }); }); ```

:warning: IMPORTANT NOTE :warning:

You need to make sure that the payload that you received from the client is actually a `Buffer` object:

```js io.on("connection", (socket) => { socket.on("hello", (val) => { if (!Buffer.isBuffer(val)) { socket.disconnect(); return; } // ... }); }); ```

**If that's already the case, then you are not impacted by this issue, and there is no way an attacker could make your server crash (or escalate privileges, ...).**

Example of values that could be sent by a malicious user:

- a number that is out of bounds

Sample packet: `451-["hello",{"_placeholder":true,"num":10}]`

```js io.on("connection", (socket) => { socket.on("hello", (val) => { // val is `undefined`…