Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like `const message = ${{ toString: '' }}` which would cause the NodeJS process to crash when sending an unexpected Socket.io message like `socket.emit('find', { toString: '' })`. A fix has been released in versions 5.0.8 and 4.5.18. Users are advised to upgrade. There is no known workaround for this vulnerability.

Affected: npm: @feathersjs/socketio, npm: @feathersjs/transport-commons

### Impact

Feathers socket handler did not catch invalid string conversion errors like:

```ts const message = `${{ toString: '' }}` ```

Causing the NodeJS process to crash when sending an unexpected Socket.io message like

```ts socket.emit('find', { toString: '' }) ```

### Patches

A fix has been released in

- `v5.0.8` via #3241 - `v4.5.18` via #3242

### Workarounds

Since it is in the core Socket handling code upgrading to the latest version is necessary. ### References

- [v5.0.8 Changelog](https://github.com/feathersjs/feathers/blob/dove/CHANGELOG.md#508-2023-07-19) - [v4.5.18 Changelog](https://github.com/feathersjs/feathers/blob/crow/CHANGELOG.md#4518-2023-07-19)