VYPR
← All advisories
Moderate severityNVD Advisory· Published Nov 22, 2022· Updated Apr 22, 2025

Uncaught exception in engine.io

CVE-2022-41940

Description

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
engine.ionpm
< 3.6.13.6.1
engine.ionpm
>= 4.0.0, < 6.2.16.2.1

Affected products

1

Patches

2
83c4071af871

fix: catch errors when destroying invalid upgrades

https://github.com/socketio/engine.ioDamien ArrachequesneNov 20, 2022via ghsa
commit
1 file changed · +3 −0
  • lib/server.js+3 −0 modified
    @@ -487,6 +487,9 @@ Server.prototype.attach = function (server, options) {
         // then the socket needs to die!
         setTimeout(function () {
           if (socket.writable && socket.bytesWritten <= 0) {
+            socket.on('error', e => {
+              debug('error while destroying upgrade: %s', e.message);
+            });
             return socket.end();
           }
         }, destroyUpgradeTimeout);
425e833ab133

fix: catch errors when destroying invalid upgrades (#658)

https://github.com/socketio/engine.ioJonathan NeveNov 17, 2022via ghsa
commit
1 file changed · +3 −0
  • lib/server.ts+3 −0 modified
    @@ -678,6 +678,9 @@ export class Server extends BaseServer {
           setTimeout(function() {
             // @ts-ignore
             if (socket.writable && socket.bytesWritten <= 0) {
+              socket.on("error", e => {
+                debug("error while destroying upgrade: %s", e.message);
+              });
               return socket.end();
             }
           }, destroyUpgradeTimeout);

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.