CVE-2022-21676
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-21676
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-21676.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-21676
- Aliases
- Related
- Published
- 2022-01-12T19:15:09Z
- Modified
- 2025-01-08T14:02:35.567666Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the
engine.iopackage starting from version4.0.0, including those who uses depending packages likesocket.io. Versions prior to4.0.0are not impacted. A fix has been released for each major branch, namely4.1.2for the4.x.xbranch,5.2.1for the5.x.xbranch, and6.1.1for the6.x.xbranch. There is no known workaround except upgrading to a safe version. - References
-
- https://github.com/socketio/engine.io/security/advisories/GHSA-273r-mgr4-v34f
- https://security.netapp.com/advisory/ntap-20220209-0002/
- https://github.com/socketio/engine.io/commit/66f889fc1d966bf5bfa0de1939069153643874ab
- https://github.com/socketio/engine.io/commit/a70800d7e96da32f6e6622804ef659ebc58659db
- https://github.com/socketio/engine.io/commit/c0e194d44933bd83bf9a4b126fca68ba7bf5098c
- https://github.com/socketio/engine.io/releases/tag/4.1.2
- https://github.com/socketio/engine.io/releases/tag/5.2.1
- https://github.com/socketio/engine.io/releases/tag/6.1.1
Affected packages
Git / github.com/socketio/engine.io
Affected ranges
- Type
- GIT
- Repo
- https://github.com/socketio/engine.io
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixedFixedFixedFixed
Affected versions
0.*
0.1.0
0.1.1
0.1.2
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.3.10
0.3.2
0.3.3
0.3.4
0.3.5
0.3.7
0.3.8
0.3.9
0.4.1
0.4.2
0.4.3
0.5.0
0.6.0
0.6.1
0.6.2
0.6.3
0.7.0
0.7.1
0.7.10
0.7.11
0.7.12
0.7.13
0.7.14
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.2
0.9.0
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3
1.6.0
1.6.1
1.6.10
1.6.11
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.8.2
2.*
2.0.0
2.0.1
2.0.2
2.1.0
3.*
3.0.0
3.1.0
3.1.1
3.1.2
3.1.3
3.2.0
3.2.1
3.3.0
3.3.1
3.3.2
3.4.0
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.1.0
4.1.1
5.*
5.0.0
5.1.0
5.1.1
5.2.0
6.*
6.0.0
6.1.0
v4.*
v4.0.0-alpha.0
v4.0.0-alpha.1