CVE-2022-41940CWE-248

Uncaught exception in engine.io

High · published November 22, 2022

CVSS v3.1
7.1
EPSS
2%
Percentile
81.3
In the wild
Unconfirmed
What it is

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.02069 · 81.3th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2022-11-22T00:00Z
EPSS history
Timeline
  • 22 NOV 00:00Z
    Uncaught exception in engine.io
    cvelistv5