Executive brief
Engine.io is a real-time communication library that powers Socket.io, widely used for live data streaming in web applications. An attacker can send specially crafted POST requests to exhaust server resources (CPU, memory), causing the application to become unresponsive or crash, disrupting service for legitimate users.
Technical details
Engine.io versions before 3.6.0 and 4.0.0 contain a resource exhaustion vulnerability (CWE-400) in the long polling transport mechanism. The vulnerability allows unauthenticated attackers to send POST requests with large payloads that exceed safe buffer limits; the default maxHttpBufferSize was 100 MB, enabling DoS attacks. The fix reduces the default buffer size to 1 MB and was implemented in commits 58e274c and 734f9d1. No special preconditions beyond network access are required; the attack vector is network-based with no authentication or user interaction needed.
Affected products
- Socket.io engine.io before 3.6.0 and before 4.0.0
Timeline
- 2021-01-08: disclosed: NVD published CVE-2020-36048
- 2021-04-06: patched: GitHub security review completed, fixes available in engine.io 3.6.0 and 4.0.0
- 2022-02-09: advisory: GHSA-j4f2-536g-r55m published