Executive brief
Engine.IO is a transport layer library used by Socket.IO to enable real-time bidirectional communication in web applications. A specially crafted HTTP request can trigger an uncaught exception that crashes the Node.js process, causing a denial of service for all users of the application. This affects any system using Engine.IO directly or indirectly through Socket.IO.
Technical details
The vulnerability is an unhandled exception (CWE-248) triggered by specially crafted HTTP requests that cause an ECONNRESET error on the TCP socket. The error occurs in Engine.IO's socket handling code when processing connection stream data, and because the error event is not properly caught, it propagates as an uncaught exception that terminates the Node.js process. The attack requires network access to the Engine.IO server but no authentication. A fix was released on 2022-11-20 with Engine.IO versions 3.6.1 and 6.2.1, and Socket.IO users should upgrade accordingly.
Affected products
- Socket.io Engine.IO < 3.6.1, >= 4.0.0 and <= 6.2.1
- Socket.io Socket.IO 2.4.x and below, 2.5.0, 3.0.x, 3.1.x, 4.0.x, 4.1.x, 4.2.x, 4.3.x, 4.4.x
Timeline
- 2022-11-20: disclosed: Advisory published
- 2022-11-20: patched: Patches released: Engine.IO 3.6.1 and 6.2.1