engine.io vulnerabilities

The realtime engine behind Socket.IO. Provides the foundation of a bidirectional connection between client and server

Registry
npm
Latest
6.6.11
License
MIT
Source
github.com/socketio/socket.io (opens the source repository in a new tab)

7 known advisories

The latest version, 6.6.11, is not affected by any of them. Projects on older versions may be.

Update to the latest version:npm install engine.io@6.6.11

Security advisories for engine.io

  • HighGHSA-2gc4-cqfq-p2gv29 Sept 2026

    Socket.IO: Engine.IO Protocol Revision Mismatch DoS

    Affected
    >=6.6.0 <6.6.10
    Fixed in
    6.6.10
  • HighGHSA-gr94-w7qr-f4j331 Aug 2026

    Socket.IO: Engine.IO WebTransport SID DoS

    Affected
    >=6.5.0 <6.6.7
    Fixed in
    6.6.7
  • HighGHSA-r635-g3xr-vw7x20 Jul 2026

    Socket.IO: Engine.IO Polling Transport Connection Exhaustion

    Affected
    >=4.1.0 <6.6.7
    Fixed in
    6.6.7
  • MediumGHSA-q9mw-68c2-j6m53 May 2023

    engine.io Uncaught Exception vulnerability

    Affected
    >=5.1.0 <6.4.2
    Fixed in
    6.4.2
  • MediumGHSA-r7qp-cfhv-p84w21 Nov 2022

    Uncaught exception in engine.io

    Affected
    <3.6.1 · >=4.0.0 <6.2.1
    Fixed in
    3.6.1, 6.2.1
  • HighGHSA-j4f2-536g-r55m9 Feb 2022

    Resource exhaustion in engine.io

    Affected
    <3.6.0
    Fixed in
    3.6.0
  • HighGHSA-273r-mgr4-v34f13 Jan 2022

    Uncaught Exception in engine.io

    Affected
    >=4.0.0 <4.1.2 · >=5.0.0 <5.2.1 · >=6.0.0 <6.1.1
    Fixed in
    4.1.2, 5.2.1, 6.1.1

Which of your client projects still run an old engine.io?

NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other npm packages

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.