NodeBB 2.6.1 Security Update

[baris]

A bug in our socket.io message parsing code can result in privilege escalation by sending a specially crafted socket.io call to the server.

We have resolved this in the latest version of NodeBB(2.6.1), and the fix has already been rolled out as a patch on all of our hosted customers.

The fix is included in the latest 2.6.1 release https://github.com/NodeBB/NodeBB/releases/tag/v2.6.1.

If you are not able to upgrade to the latest release, you can also cherry-pick or apply this commit manually https://github.com/NodeBB/NodeBB/commit/48d143921753914da45926cca6370a92ed0c46b8

We will update this post with a link to the CVE once its published.

[julian]

The security advisory has now been published