Security: Vulnerability in @react-pdf/png-js dependency chain (socket.io-parser < 4.2.1)

[sunanmau5]

A security vulnerability has been identified in the dependency chain of @react-pdf/png-js. The package uses [email protected], which ultimately depends on an outdated version of socket.io-parser (2.3.1) through the following dependency chain:

@react-pdf/png-js
└─ [email protected]
   └─ [email protected]
      └─ [email protected]
         └─ [email protected]

The vulnerability exists in the Socket.io js library due to improper type validation in attachment parsing. This security flaw allows attackers to overwrite the _placeholder object, potentially enabling them to place references to functions at arbitrary places in the resulting query object.

The vulnerability can be addressed by updating socket.io-parser to version 4.2.1 or higher. However, since browserify-zlib is no longer maintained, addressing this security issue through normal dependency updates is challenging.