Vulnerability · Published Nov 22, 2022 · Assigned by GitHub_M
CVE-2022-41940Uncaught exception in engine.io
High 7.1
In plain English
A high-severity security flaw in engine.io from socketio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | engine.io | 3.6.1 | GHSA-r7qp-cfhv-p84w |
| npm | engine.io | 6.2.1 | GHSA-r7qp-cfhv-p84w |
Affected products (as reported)
Weakness: CWE-248 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H