Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A denial-of-service vulnerability exists in Engine.IO / Socket.IO servers that allow transport upgrades. The Engine.IO protocol revision is negotiated during the initial handshake and stored on the session, but a newly-created transport, including a WebSocket upgrade transport, could independently derive a different protocol revision from the upgrade request query parameters. The server did not verify that the protocol revision of an upgrade request matched the protocol revision of the existing session. A malicious client could exploit this mismatch by establishing a valid Engine.IO session and then sending an upgrade request with a different, or omitted, EIO query parameter. This could cause the server to attach a transport using a parser and heartbeat behavior inconsistent with the session. Under some conditions, a crafted heartbeat packet could trigger an uncaught exception and terminate the Node.js process. Servers using the default Engine.IO v4 protocol are impacted. The…
Recommended action: Upgrade to 6.6.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Engine.IO servers with WebTransport enabled are vulnerable to a remotely triggerable denial of service. A malicious unauthenticated client can send a crafted WebTransport upgrade request containing a specially chosen session ID, such as proto. Because the session ID lookup did not properly verify that the key was an own property of the clients object, the lookup could resolve to an inherited prototype property instead of a valid Engine.IO client. This can cause a TypeError during WebTransport upgrade handling. Since the failure occurs in an asynchronous context, it may result in an unhandled Promise rejection and terminate the Node.js process on affected Node.js versions/configurations. Successful exploitation can allow an unauthenticated remote attacker to crash the server process and cause denial of service. Under a process supervisor, repeated exploitation may cause crash loops. Affected configurations are limited to deployments where WebTransport support is enabled.…
Recommended action: Upgrade to 6.6.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An unauthenticated remote attacker can cause a denial of service in affected versions of engine.io by opening Engine.IO polling sessions and sending an invalid binary POST request with: against an Engine.IO protocol v4 polling transport. In the vulnerable code path, the server reports a transport error but does not properly close the HTTP response associated with the malformed request. As a result, the underlying HTTP connection may remain open, consuming one server-side socket/resource per crafted request. An attacker can repeat this with many sessions to exhaust available HTTP connections, sockets, file descriptors, or related server resources, potentially preventing legitimate clients from connecting. Patches The issue was fixed in: - engine.io 6.6.7 The fix ensures that invalid binary polling POST requests are explicitly rejected with an HTTP response and closed properly. Users should upgrade to: or a later fixed version. If using Socket.IO through the monorepo/packages,…
Recommended action: Upgrade to 6.6.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. Patches A fix has been released today (2023/05/02): 6.4.2 This bug was introduced in version 5.1.0 and included in version 4.1.0 of the socket.io parent package. Older versions are not impacted. For socket.io users: | Version range | engine.io version | Needs minor update? | |-----------------------------|---------------------|--------------------------------------------------------------------------------------------------------| | socket.io@4.6.x | ~6.4.0 | npm audit fix should be sufficient | | socket.io@4.5.x | ~6.2.0 | Please upgrade to socket.io@4.6.x | | socket.io@4.4.x | ~6.1.0 | Please upgrade to socket.io@4.6.x | | socket.io@4.3.x | ~6.0.0 | Please upgrade to socket.io@4.6.x | | socket.io@4.2.x | ~5.2.0 | Please upgrade to…
Recommended action: Upgrade to 6.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. Patches A fix has been released today (2022/11/20): | Version range | Fixed version | |-------------------|---------------| | engine.io@3.x.y | 3.6.1 | | engine.io@6.x.y | 6.2.1 | For socket.io users: | Version range | engine.io version | Needs minor update? | |-----------------------------|---------------------|--------------------------------------------------------------------------------------------------------| | socket.io@4.5.x | ~6.2.0 | npm audit fix should be sufficient | | socket.io@4.4.x | ~6.1.0 | Please upgrade to socket.io@4.5.x | | socket.io@4.3.x | ~6.0.0 | Please upgrade to socket.io@4.5.x | | socket.io@4.2.x | ~5.2.0 | Please upgrade to socket.io@4.5.x | | socket.io@4.1.x | ~5.1.1 | Please upgrade to socket.io@4.5.x | |…
Recommended action: Upgrade to 6.2.1 or 3.6.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
Recommended action: Upgrade to 3.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. RangeError: Invalid WebSocket frame: RSV2 and RSV3 must be clear at Receiver.getInfo (/.../nodemodules/ws/lib/receiver.js:176:14) at Receiver.startLoop (/.../nodemodules/ws/lib/receiver.js:136:22) at Receiver.write (/.../nodemodules/ws/lib/receiver.js:83:10) at writeOrBuffer (internal/streams/writable.js:358:12) This impacts all the users of the engine.io package starting from version 4.0.0, including those who uses depending packages like socket.io. Patches A fix has been released for each major branch: | Version range | Fixed version | | --- | --- | | engine.io@4.x.x | 4.1.2 | | engine.io@5.x.x | 5.2.1 | | engine.io@6.x.x | 6.1.1 | Previous versions (< 4.0.0) are not impacted. For socket.io users: | Version range | engine.io version | Needs minor update? | | --- | --- | --- | | socket.io@4.4.x | ~6.1.0 | - | socket.io@4.3.x | ~6.0.0 | Please upgrade…
Recommended action: Upgrade to 6.1.1, 5.2.1 or 4.1.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.