CVE-2022-41940

 

Published at: - 22-11-2022 02:15

Last modified: - 22-11-2022 02:44

Total changes: - 1

Description

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.

Common Vulnerability Scoring System (CVSS)

-

 

Verification logic

 

Reference

• https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085
• https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6
• https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w

 

Keywords

NVD

 

CVE-2022-41940

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures