CVE-2022-21676: Uncaught Exception in engine.io
Summary
CVE-2022-21676: Uncaught Exception in engine.io. Affects engine.io across 3 version ranges.
>= 4.0.0, < 4.1.2
>= 5.0.0, < 5.2.1
>= 6.0.0, < 6.1.1
Fixed in 4.1.2, 5.2.1 or 6.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The engine.io package is an open-source library for real-time communication between clients and servers. It provides a framework for bidirectional communication using websockets and other transport protocols. The package is widely used in applications that require real-time updates, such as chat applications, collaborative tools, and multiplayer games. However, a vulnerability has been discovered in versions 4.0.0 and above of the engine.io package, which can be exploited by a specially crafted HTTP request to trigger an uncaught exception on the server, leading to the termination of the Node.js process.
Vulnerability Detail
The vulnerability in the engine.io package allows an attacker to send a malicious HTTP request that triggers an uncaught exception on the server. This exception, caused by an invalid WebSocket frame, can lead to the termination of the Node.js process. The impact of this vulnerability is significant, as it affects all users of the engine.io package starting from version 4.0.0, including those who use depending packages like socket.io. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 6.6.11 as of 23 Oct 2026
npm install engine.io@6.6.11Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.1.24.1.2npm install engine.io@4.1.2 -
>= 5.0.0, < 5.2.15.2.1npm install engine.io@5.2.1 -
>= 6.0.0, < 6.1.16.1.1npm install engine.io@6.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to a safe version of the engine.io package.
Conclusion
The vulnerability in the engine.io package can be exploited to terminate the Node.js process by sending a specially crafted HTTP request. To mitigate this vulnerability, it is crucial to update the engine.io package to a safe version. Users of the socket.io package should also ensure they are using a compatible version of engine.io. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for engine.io →
FAQ
The vulnerability can be exploited by sending a specially crafted HTTP request, leading to the termination of the Node.js process. This can disrupt the functionality of applications that rely on the engine.io package for real-time communication.
The vulnerability affects versions 4.0.0 and above of the engine.io package. Versions prior to 4.0.0 are not impacted.
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to a safe version of the engine.io package.
To fix the vulnerability, update the engine.io package to a safe version. Refer to the provided table for the fixed versions corresponding to each major branch. Users of the socket.io package should also ensure they are using a compatible version of engine.io.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your package-lock.json file without requiring any signup or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for engine.io.
