Vulnerabilities > CVE-2022-41940 - Unspecified vulnerability in Socket Engine.Io

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

socket

NVD

Published: 2022-11-22

Updated: 2024-11-21

Summary

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.

Vulnerable Configurations

Part	Description	Count
Application	Socket Socket Engine.Io 0.1.0 Socket Engine.Io 0.1.1 Socket Engine.Io 0.1.2 Socket Engine.Io 0.2.0 Socket Engine.Io 0.2.1 Socket Engine.Io 0.2.2 Socket Engine.Io 0.3.0 Socket Engine.Io 0.3.1 Socket Engine.Io 0.3.2 Socket Engine.Io 0.3.3 Socket Engine.Io 0.3.4 Socket Engine.Io 0.3.5 Socket Engine.Io 0.3.7 Socket Engine.Io 0.3.8 Socket Engine.Io 0.3.9 Socket Engine.Io 0.3.10 Socket Engine.Io 0.4.1 Socket Engine.Io 0.4.2 Socket Engine.Io 0.4.3 Socket Engine.Io 0.5.0 Socket Engine.Io 0.6.0 Socket Engine.Io 0.6.1 Socket Engine.Io 0.6.2 Socket Engine.Io 0.6.3 Socket Engine.Io 0.7.0 Socket Engine.Io 0.7.1 Socket Engine.Io 0.7.2 Socket Engine.Io 0.7.3 Socket Engine.Io 0.7.4 Socket Engine.Io 0.7.5 Socket Engine.Io 0.7.6 Socket Engine.Io 0.7.7 Socket Engine.Io 0.7.8 Socket Engine.Io 0.7.9 Socket Engine.Io 0.7.10 Socket Engine.Io 0.7.11 Socket Engine.Io 0.7.12 Socket Engine.Io 0.7.13 Socket Engine.Io 0.7.14 Socket Engine.Io 0.8.0 Socket Engine.Io 0.8.1 Socket Engine.Io 0.8.2 Socket Engine.Io 0.9.0 Socket Engine.Io 1.0.0 Socket Engine.Io 1.0.1 Socket Engine.Io 1.0.2 Socket Engine.Io 1.0.3 Socket Engine.Io 1.0.4 Socket Engine.Io 1.0.5 Socket Engine.Io 1.1.0 Socket Engine.Io 1.1.1 Socket Engine.Io 1.2.0 Socket Engine.Io 1.2.1 Socket Engine.Io 1.2.2 Socket Engine.Io 1.3.0 Socket Engine.Io 1.3.1 Socket Engine.Io 1.4.0 Socket Engine.Io 1.4.1 Socket Engine.Io 1.4.2 Socket Engine.Io 1.4.3 Socket Engine.Io 1.5.0 Socket Engine.Io 1.5.1 Socket Engine.Io 1.5.2 Socket Engine.Io 1.5.3 Socket Engine.Io 1.6.0 Socket Engine.Io 1.6.1 Socket Engine.Io 1.6.2 Socket Engine.Io 1.6.3 Socket Engine.Io 1.6.4 Socket Engine.Io 1.6.5 Socket Engine.Io 1.6.6 Socket Engine.Io 1.6.7 Socket Engine.Io 1.6.8 Socket Engine.Io 1.6.10 Socket Engine.Io 1.6.11 Socket Engine.Io 1.7.0 Socket Engine.Io 1.7.1 Socket Engine.Io 1.7.2 Socket Engine.Io 1.8.0 Socket Engine.Io 1.8.1 Socket Engine.Io 1.8.2 Socket Engine.Io 1.8.3 Socket Engine.Io 1.8.4 Socket Engine.Io 1.8.5 Socket Engine.Io 2.0.0 Socket Engine.Io 2.0.1 Socket Engine.Io 2.0.2 Socket Engine.Io 2.1.0 Socket Engine.Io 2.1.1 Socket Engine.Io 3.0.0 Socket Engine.Io 3.1.0 Socket Engine.Io 3.1.1 Socket Engine.Io 3.1.2 Socket Engine.Io 3.1.3 Socket Engine.Io 3.1.4 Socket Engine.Io 3.1.5 Socket Engine.Io 3.2.0 Socket Engine.Io 3.2.1 Socket Engine.Io 3.3.0 Socket Engine.Io 3.3.1 Socket Engine.Io 3.3.2 Socket Engine.Io 3.4.0 Socket Engine.Io 3.4.1 Socket Engine.Io 3.4.2 Socket Engine.Io 3.5.0 Socket Engine.Io 3.6.0 Socket Engine.Io 4.0.0 Socket Engine.Io 4.0.1 Socket Engine.Io 4.0.2 Socket Engine.Io 4.0.3 Socket Engine.Io 4.0.4 Socket Engine.Io 4.0.5 Socket Engine.Io 4.0.6 Socket Engine.Io 4.1.0 Socket Engine.Io 4.1.1 Socket Engine.Io 4.1.2 Socket Engine.Io 5.0.0 Socket Engine.Io 5.1.0 Socket Engine.Io 5.1.1 Socket Engine.Io 5.2.0 Socket Engine.Io 5.2.1 Socket Engine.Io 6.0.0 Socket Engine.Io 6.0.1 Socket Engine.Io 6.1.0 Socket Engine.Io 6.1.1 Socket Engine.Io 6.1.2 Socket Engine.Io 6.1.3 Socket Engine.Io 6.2.0	130

Summary

Vulnerable Configurations

References