Quick answers
- Is CVE-2020-36048 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-36048 being exploited in the wild.
- How severe is CVE-2020-36048?
- Low severity, with a CVSS score of 3.1, published 9 February 2022.
- Which products and versions are affected?
- engine.io (npm) SEMVER:introduced=0,fixed=3.6.0.
- Is there a fix for CVE-2020-36048?
- Yes. engine.io (npm): upgrade to 3.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-36048 attacked?
- It is attacked over the network.
- Am I affected by CVE-2020-36048?
- Check whether you run engine.io (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- engine.io (npm): upgrade to 3.6.0 or later
npm install engine.io@3.6.0
Technical details
Engine.io versions before 3.6.0 and 4.0.0 contain a resource exhaustion vulnerability (CWE-400) in the long polling transport mechanism. The vulnerability allows unauthenticated attackers to send POST requests with large payloads that exceed safe buffer limits; the default maxHttpBufferSize was 100 MB, enabling DoS attacks. The fix reduces the default buffer size to 1 MB and was implemented in commits 58e274c and 734f9d1. No special preconditions beyond network access are required; the attack vector is network-based with no authentication or user interaction needed.
Affected products
- Socket.io engine.io before 3.6.0 and before 4.0.0
Identifiers
- CVE-2020-36048
- GHSA-j4f2-536g-r55m
Timeline
- 2021-01-08: disclosed: NVD published CVE-2020-36048
- 2021-04-06: patched: GitHub security review completed, fixes available in engine.io 3.6.0 and 4.0.0
- 2022-02-09: advisory: GHSA-j4f2-536g-r55m published