[GHSA-25hc-qcg6-38wj] socket.io has an unhandled 'error' event

[nikpivkin]

Updates

• Affected products
• CVSS v3

Comments
The range of the 2.x entry should end at < 2.5.1, not < 2.5.0.

The advisory text lists "2.3.0...2.5.0" as affected with "Please upgrade to socket.io@2.5.1". The 2.x fix socketio/socket.io@d30630b is in tag 2.5.1 and not in tag 2.5.0.

So version 2.5.0 is still vulnerable but is outside the current range.

[github]

Hi there @darrachequesne! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[nikpivkin]

The removal of the CVSS_V3 score is not intended. I only changed the range of the 2.x entry. The form keeps only one CVSS vector, see #9628. Please keep CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

[Copilot]

Copilot review overview

🟢 Approval recommended

The resulting range correctly ends at the verified fix in socket.io 2.5.1.

Review effort: Balanced
Findings: None

What changed in this PR

Updates the socket.io advisory to correctly include version 2.5.0 as vulnerable.

Changes:

• Removes the obsolete < 2.5.0 affected-version cap.
• Removes the CVSS v3 entry while retaining CVSS v4.

File	Description
GHSA-25hc-qcg6-38wj.json	Corrects advisory metadata and affected-version handling.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.