CVE-2022-21676: socket engine.io
Vulnerability summary
CVE-2022-21676 is a high (CVSS 7.5) vulnerability in socket engine.io. EPSS estimates a 2.76% chance of exploitation in the next 30 days, higher than 86% of scored vulnerabilities.
Timeline
- 12-01-2022PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the `engine.io` package starting from version `4.0.0`, including those who uses depending packages like `socket.io`. Versions prior to `4.0.0` are not impacted. A fix has been released for each major branch, namely `4.1.2` for the `4.x.x` branch, `5.2.1` for the `5.x.x` branch, and `6.1.1` for the `6.x.x` branch. There is no known workaround except upgrading to a safe version.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.76%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
0.00 pp
From 2.76% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
- CWE-755Improper Handling of Exceptional ConditionsThe product does not handle or incorrectly handles an exceptional condition.
Affected systems
Npm1 product
- engine.io≥ 4.0.0, < 4.1.2 | ≥ 5.0.0, < 5.2.1 | ≥ 6.0.0, < 6.1.1
Socket1 product
- engine.io≥ 4.0.0, < 4.1.2 | ≥ 5.0.0, < 5.2.1 | ≥ 6.0.0, < 6.1.1
Socketio1 product
- engine.io≥ 4.0.0, < 4.1.2 | ≥ 5.0.0, < 5.2.1 | ≥ 6.0.0, < 6.1.1
3 vendors · 3 products
References
11 links- github.com/socketio/engine.io/security/advisories/GHSA-273r-mgr4-v34fX Refsource CONFIRMWEBThird Party Advisory
- github.com/socketio/engine.io/commit/66f889fc1d966bf5bfa0de1939069153643874abX Refsource MISCWEBPatchThird Party Advisory
- github.com/socketio/engine.io/commit/a70800d7e96da32f6e6622804ef659ebc58659dbX Refsource MISCWEBPatchThird Party Advisory
- github.com/socketio/engine.io/commit/c0e194d44933bd83bf9a4b126fca68ba7bf5098cX Refsource MISCWEBPatchThird Party Advisory
- github.com/socketio/engine.io/releases/tag/4.1.2X Refsource MISCWEBRelease NotesThird Party Advisory
- github.com/socketio/engine.io/releases/tag/5.2.1X Refsource MISCWEBRelease NotesThird Party Advisory
- github.com/socketio/engine.io/releases/tag/6.1.1X Refsource MISCWEBRelease NotesThird Party Advisory
