CVE-2020-36049: 
JavaScript vulnerability analysis and mitigation

CVE-2020-36049 affects socket.io-parser versions before 3.4.1, allowing attackers to cause a denial of service through memory consumption. The vulnerability was discovered when a concatenation approach used in packet processing could be exploited via large packets (NVD).

The vulnerability exists in the packet processing mechanism where the parser uses string concatenation for handling packets. When processing large packets, the implementation creates many ConsOneByteString objects (32 bytes each) through concatenation operations, leading to excessive memory usage. The vulnerability has a CVSS v3.1 Base Score of 7.5 HIGH with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD, Socket.IO Blog).

The vulnerability can lead to denial of service through excessive memory consumption. When exploited, a single HTTP POST request can cause extreme CPU and memory usage, potentially causing the server to crash with a JavaScript heap out of memory fatal error (Socket.IO Blog).

The vulnerability can be exploited through the HTTP long-polling transport by sending a payload containing either many tiny packets, one giant integer packet, or many heartbeat packets. The maximum HTTP body size of 100MB can be leveraged to cause significant resource consumption (Socket.IO Blog, Kill Engine POC).

The vulnerability was fixed in socket.io-parser version 3.4.1 by improving the string handling approach to use substring rather than concatenation. The fix prevents the build-up of ConsOneByteString objects that led to memory exhaustion (Parser Fix).