HighGHSA-j4f2-536g-r55mCVE-2020-36048

Resource exhaustion in engine.io

Published 9 Feb 2022 · Updated 29 May 2025

Affected package

Affected: <3.6.0
Fixed in: 3.6.0

Update to the fixed version for your release line, for example:npm install engine.io@3.6.0

Details

Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.

Is GHSA-j4f2-536g-r55m in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected engine.io, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2020-36048
Linkgithub.com/socketio/engine.io/commit/58e274c437e9cbcf69fd913c813aad8fbd253703
Linkgithub.com/socketio/engine.io/commit/734f9d1268840722c41219e69eb58318e0b2ac6b
Linkblog.caller.xyz/socketio-engineio-dos
Linkgithub.com/bcaller/kill-engine-io
Packagegithub.com/socketio/engine.io

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.