# Security Policy

## Supported Versions

| Version | Supported          |
|---------|--------------------|
| 4.x     | :white_check_mark: |
| 3.x     | :white_check_mark: |
| < 3.0   | :x:                |

## Reporting a Vulnerability

To report a security vulnerability in this package, please send an email to [@darrachequesne](https://github.com/darrachequesne) (see address in profile) describing the vulnerability and how to reproduce it.

We will get back to you as soon as possible and publish a fix if necessary.

:warning: IMPORTANT :warning: please do not create an issue in this repository, as attackers might take advantage of it. Thank you in advance for your responsible disclosure.

## History

| Date         | Description                                                                                                   | CVE number     |
|--------------|---------------------------------------------------------------------------------------------------------------|----------------|
| January 2021 | [Resource exhaustion in socket.io-parser](https://github.com/advisories/GHSA-xfhh-g9f5-x4m4)                  | CVE-2020-36049 |
| October 2022 | [Insufficient validation when decoding a Socket.IO packet](https://github.com/advisories/GHSA-qm95-pgcg-qqfq) | CVE-2022-2421  |
| May 2023     | [Insufficient validation when decoding a Socket.IO packet](https://github.com/advisories/GHSA-cqmj-92xf-r6r9) | CVE-2023-32695 |
