CVE-2022-41940
Uncaught exception in engine.io
- State
- Published
- Severity
- 7.1 High
- Published
- Nov 22, 2022
- Updated
- Apr 22, 2025
- Reserved
- Sep 30, 2022
Description
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H | GitHub_M |
Weaknesses
- CWE-248 Uncaught Exception
Affected Products
| Product | Versions |
|---|---|
engine.iosocketio |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.