Skip to content
OpenAdvisories

Package · npm

engine.io

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • High 7.5
    CVE-2026-102599

    Socket.IO: Engine.IO Protocol Revision Mismatch DoS

    Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored …

    socketio socket.io engine.io npm
  • High 7.5
    CVE-2026-59725

    Socket.IO: Engine.IO Polling Transport Connection Exhaustion

    Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-…

    socketio engine.io engine.io npm
  • High 7.5
    CVE-2026-59724

    Socket.IO: Engine.IO WebTransport SID DoS

    Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object durin…

    socketio socket.io engine.io npm
  • Medium 6.5
    CVE-2023-31125

    Uncaught exception in engine.io

    Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught exception vulnerability was introduced in version 5.1.0 and included in version 4.1.0 of the `socket.io` parent package…

    socketio engine.io engine.io npm
  • High 7.1
    CVE-2022-41940

    Uncaught exception in engine.io

    Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This …

    socketio engine.io engine.io npm
  • High 7.5
    CVE-2022-21676

    Uncaught Exception in engine.io

    Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This …

    socketio engine.io engine.io npm
  • High 7.5
    CVE-2020-36048

    Resource exhaustion in engine.io

    Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.

    engine.io npm