From ea0733f8bf00181466693529022c787608d9f805 Mon Sep 17 00:00:00 2001
From: Damien Arrachequesne <damien.arrachequesne@gmail.com>
Date: Wed, 15 Jul 2026 15:30:32 +0200
Subject: [PATCH] fix(parser): reject binary packets with zero attachments

---
 packages/socket.io-parser/lib/index.ts   | 7 +------
 packages/socket.io-parser/test/parser.js | 1 +
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/packages/socket.io-parser/lib/index.ts b/packages/socket.io-parser/lib/index.ts
index 324568b159..33b034368e 100644
--- a/packages/socket.io-parser/lib/index.ts
+++ b/packages/socket.io-parser/lib/index.ts
@@ -190,11 +190,6 @@ export class Decoder extends Emitter<{}, {}, DecoderReservedEvents> {
         packet.type = isBinaryEvent ? PacketType.EVENT : PacketType.ACK;
         // binary packet's json
         this.reconstructor = new BinaryReconstructor(packet);
-
-        // no attachments, labeled binary but no binary data to follow
-        if (packet.attachments === 0) {
-          super.emitReserved("decoded", packet);
-        }
       } else {
         // non-binary full packet
         super.emitReserved("decoded", packet);
@@ -245,7 +240,7 @@ export class Decoder extends Emitter<{}, {}, DecoderReservedEvents> {
         throw new Error("Illegal attachments");
       }
       const n = Number(buf);
-      if (!isInteger(n) || n < 0) {
+      if (!isInteger(n) || n < 1) {
         throw new Error("Illegal attachments");
       } else if (n > this.opts.maxAttachments) {
         throw new Error("too many attachments");
diff --git a/packages/socket.io-parser/test/parser.js b/packages/socket.io-parser/test/parser.js
index 63e8907213..e5b3a631d3 100644
--- a/packages/socket.io-parser/test/parser.js
+++ b/packages/socket.io-parser/test/parser.js
@@ -182,6 +182,7 @@ describe("socket.io-parser", () => {
 
     isInvalidAttachmentCount("5");
     isInvalidAttachmentCount("51");
+    isInvalidAttachmentCount("50-");
     isInvalidAttachmentCount("5a-");
     isInvalidAttachmentCount("51.23-");