CVE-2022-41940

HIGH

engine.io < 3.6.1 - Denial of Service via Crafted HTTP Request

Title source: llm
STIX 2.1

Description

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.

References (3)

Core 3

Scores

CVSS v3 7.1
EPSS 0.0194
EPSS Percentile 77.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-248
Status published
Products (2)
npm/engine.io 0 - 3.6.1npm
socket/engine.io < 3.6.1
Published Nov 22, 2022
Tracked Since Feb 18, 2026