← Vulnerability feed

Vulnerability record · CVE-2022-41940 · published 22 November 2022

CVE-2022-41940: Socket engine.io vulnerability

Socket · Engine.Io

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.

6.5 CVSS 3.1 Medium EPSS 2.1% · top 19.3% CWE-248 · CWE-248
6.5CVSS 3.1 base score
2.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6 PatchThird Party Advisory
https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085 PatchThird Party Advisory
https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w ExploitThird Party Advisory
https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6 PatchThird Party Advisory
https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085 PatchThird Party Advisory
https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w ExploitThird Party Advisory

Track CVE-2022-41940 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-59725Socket engine.io improper resource shutdown vulnerabilitySocket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport do…EPSS 0.64%7.5CVE-2026-59724Socket engine.io improper input validation vulnerabilitySocket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enable…EPSS 0.61%7.5CVE-2022-21676Socket engine.io vulnerabilityEngine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted H…EPSS 2.8%7.5CVE-2020-36048Socket engine.io uncontrolled resource consumption vulnerabilityEngine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.EPSS 3.2%6.5CVE-2023-31125Socket engine.io vulnerabilityEngine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught exception…EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2022-41940), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.