CVE-2022-21676

HIGH
Published Jan 12, 20224y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Jan 12, 2022 4y ago
Last Modified Jun 17, 2026 2w ago

Description

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the `engine.io` package starting from version `4.0.0`, including those who uses depending packages like `socket.io`. Versions prior to `4.0.0` are not impacted. A fix has been released for each major branch, namely `4.1.2` for the `4.x.x` branch, `5.2.1` for the `5.x.x` branch, and `6.1.1` for the `6.x.x` branch. There is no known workaround except upgrading to a safe version.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-754
CWE-755

Affected Products 3

VendorProductVersionRange
socketengine.io*≥4.0.0  –  <4.1.2
socketengine.io*≥5.0.0  –  <5.2.1
socketengine.io*≥6.0.0  –  <6.1.1

References 8

  • github.com https://github.com/socketio/engine.io/commit/66f889fc1d966bf5bfa0de1939069153643874ab
    PatchThird Party Advisory
  • github.com https://github.com/socketio/engine.io/commit/a70800d7e96da32f6e6622804ef659ebc58659db
    PatchThird Party Advisory
  • github.com https://github.com/socketio/engine.io/commit/c0e194d44933bd83bf9a4b126fca68ba7bf5098c
    PatchThird Party Advisory
  • github.com https://github.com/socketio/engine.io/releases/tag/4.1.2
    Release NotesThird Party Advisory
  • github.com https://github.com/socketio/engine.io/releases/tag/5.2.1
    Release NotesThird Party Advisory
  • github.com https://github.com/socketio/engine.io/releases/tag/6.1.1
    Release NotesThird Party Advisory
  • github.com https://github.com/socketio/engine.io/security/advisories/GHSA-273r-mgr4-v34f
    Third Party Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20220209-0002/
    Third Party Advisory

Remediation

  • github.com https://github.com/socketio/engine.io/commit/66f889fc1d966bf5bfa0de1939069153643874ab
    PatchThird Party Advisory
  • github.com https://github.com/socketio/engine.io/commit/a70800d7e96da32f6e6622804ef659ebc58659db
    PatchThird Party Advisory
  • github.com https://github.com/socketio/engine.io/commit/c0e194d44933bd83bf9a4b126fca68ba7bf5098c
    PatchThird Party Advisory