Executive brief
Engine.IO is a low-level communication library used by Socket.IO to enable real-time, bidirectional communication in Node.js web applications. A specially crafted HTTP request can trigger an uncaught exception that crashes the entire Node.js process, causing service outages for any application relying on this library.
Technical details
This vulnerability is an uncaught exception (CWE-248) triggered by a specially crafted HTTP request sent to an Engine.IO server. The crash occurs when the server attempts to read the 'handlesUpgrades' property from an undefined object in the onWebSocket handler, resulting in a fatal TypeError that kills the Node.js process. The vulnerability is remotely exploitable over the network without authentication. The flaw was introduced in engine.io version 5.1.0 and propagated to socket.io 4.1.0 and later. A patch was released on 2023-05-02 with engine.io version 6.4.2.
Affected products
- Socket.IO engine.io 5.1.0 to 6.4.1
- Socket.IO socket.io 4.1.0 to 4.6.x
Timeline
- 2023-05-01: disclosed: Security advisory published
- 2023-05-02: patched: engine.io 6.4.2 released with fix
- 2023-05-03: advisory: GHSA-q9mw-68c2-j6m5 published