Vulnerability Details : CVE-2022-41940
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.
Products affected by CVE-2022-41940
- cpe:2.3:a:socket:engine.io:*:*:*:*:*:node.js:*:*
- cpe:2.3:a:socket:engine.io:*:*:*:*:*:node.js:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-41940
0.10%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 41 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-41940
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
2.8
|
3.6
|
NIST | |
|
7.1
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H |
1.6
|
5.5
|
GitHub, Inc. |
CWE ids for CVE-2022-41940
-
An exception is thrown from a function, but it is not caught.Assigned by: security-advisories@github.com (Primary)
References for CVE-2022-41940
-
https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085
fix: catch errors when destroying invalid upgrades · socketio/engine.io@83c4071 · GitHubPatch;Third Party Advisory
-
https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w
Uncaught exception in engine.io · Advisory · socketio/engine.io · GitHubExploit;Third Party Advisory
-
https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6
fix: catch errors when destroying invalid upgrades (#658) · socketio/engine.io@425e833 · GitHubPatch;Third Party Advisory
Jump to