# CVE-2023-31125: Socket.IO engine.io uncaught exception denial of service

Source: https://junglewise.ai/threats/cve-2023-31125-socket-io-engine-io-uncaught-exception-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-05-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-31125 · Severity: low · CVSS 3.1 · Published 2023-05-03

Engine.IO is a low-level communication library used by Socket.IO to enable real-time, bidirectional communication in Node.js web applications. A specially crafted HTTP request can trigger an uncaught exception that crashes the entire Node.js process, causing service outages for any application relying on this library.

Technologies: [engine.io (npm)](https://junglewise.ai/threats/technologies/engine-io). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-31125 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-31125 being exploited in the wild.

**How severe is CVE-2023-31125?** Low severity, with a CVSS score of 3.1, published 3 May 2023.

**Which products and versions are affected?** engine.io (npm) SEMVER:introduced=5.1.0,fixed=6.4.2.

**Is there a fix for CVE-2023-31125?** Yes. engine.io (npm): upgrade to 6.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-31125 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-31125?** Check whether you run engine.io (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- engine.io (npm): upgrade to 6.4.2 or later

  ```sh
  npm install engine.io@6.4.2
  ```


## Technical details

This vulnerability is an uncaught exception (CWE-248) triggered by a specially crafted HTTP request sent to an Engine.IO server. The crash occurs when the server attempts to read the 'handlesUpgrades' property from an undefined object in the onWebSocket handler, resulting in a fatal TypeError that kills the Node.js process. The vulnerability is remotely exploitable over the network without authentication. The flaw was introduced in engine.io version 5.1.0 and propagated to socket.io 4.1.0 and later. A patch was released on 2023-05-02 with engine.io version 6.4.2.

## Affected products

- Socket.IO engine.io 5.1.0 to 6.4.1
- Socket.IO socket.io 4.1.0 to 4.6.x

## Identifiers

- CVE-2023-31125
- GHSA-q9mw-68c2-j6m5

## Timeline

- 2023-05-01: disclosed: Security advisory published
- 2023-05-02: patched: engine.io 6.4.2 released with fix
- 2023-05-03: advisory: GHSA-q9mw-68c2-j6m5 published

## References

- [https://github.com/socketio/engine.io/security/advisories/GHSA-q9mw-68c2-j6m5](https://github.com/socketio/engine.io/security/advisories/GHSA-q9mw-68c2-j6m5)

## Related threats

- [Socket.IO Engine.IO protocol revision mismatch DoS](https://junglewise.ai/threats/cve-2026-102599-socket-io-engine-io-protocol-revision-mismatch-dos)
- [Socket.IO Engine.IO connection exhaustion in polling transport](https://junglewise.ai/threats/cve-2026-59725-socket-io-engine-io-connection-exhaustion-in-polling-transport)
- [Socket.IO Engine.IO denial of service in WebTransport upgrade handling](https://junglewise.ai/threats/cve-2026-59724-socket-io-engine-io-denial-of-service-in-webtransport-upgrade)
- [Engine.IO uncaught exception denial of service](https://junglewise.ai/threats/cve-2022-41940-engine-io-uncaught-exception-denial-of-service)
- [Socket.io engine.io resource exhaustion via POST](https://junglewise.ai/threats/cve-2020-36048-socket-io-engine-io-resource-exhaustion-via-post)