socketio engine.io vulnerabilities

Latest socketio engine.io CVEs

Newest publication first

1. CVE-2026-59725 Socket.IO: Engine.IO Polling Transport Connection Exhaustion

   Published 2026-07-08

   High·CVSS 7.5

   Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an u...

2. CVE-2023-31125 Uncaught exception in engine.io

   Published 2023-05-08

   Medium·CVSS 6.5

   Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught exception vulnerability was introduced in version 5.1.0 and included in version 4.1.0 of the socket.io parent package. Older versions are no...

3. CVE-2022-41940 Uncaught exception in engine.io

   Published 2022-11-22

   Medium·CVSS 6.5 EPSS 2.1%

   Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users...

4. CVE-2022-21676 Uncaught Exception in engine.io

   Published 2022-01-12

   High·CVSS 7.5

   Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.