GHSA-273r-mgr4-v34f

Suggest an improvement
Source
https://github.com/advisories/GHSA-273r-mgr4-v34f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-273r-mgr4-v34f/GHSA-273r-mgr4-v34f.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-273r-mgr4-v34f
Aliases
Published
2022-01-13T16:14:17Z
Modified
2023-11-08T04:08:07Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Uncaught Exception in engine.io
Details

Impact

A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.

RangeError: Invalid WebSocket frame: RSV2 and RSV3 must be clear at Receiver.getInfo (/.../node_modules/ws/lib/receiver.js:176:14) at Receiver.startLoop (/.../node_modules/ws/lib/receiver.js:136:22) at Receiver._write (/.../node_modules/ws/lib/receiver.js:83:10) at writeOrBuffer (internal/streams/writable.js:358:12)

This impacts all the users of the engine.io package starting from version 4.0.0, including those who uses depending packages like socket.io.

Patches

A fix has been released for each major branch:

Version range Fixed version
engine.io@4.x.x 4.1.2
engine.io@5.x.x 5.2.1
engine.io@6.x.x 6.1.1

Previous versions (< 4.0.0) are not impacted.

For socket.io users:

Version range engine.io version Needs minor update?
socket.io@4.4.x ~6.1.0 -
socket.io@4.3.x ~6.0.0 Please upgrade to socket.io@4.4.x
socket.io@4.2.x ~5.2.0 -
socket.io@4.1.x ~5.1.1 Please upgrade to socket.io@4.4.x
socket.io@4.0.x ~5.0.0 Please upgrade to socket.io@4.4.x
socket.io@3.1.x ~4.1.0 -
socket.io@3.0.x ~4.0.0 Please upgrade to socket.io@3.1.x or socket.io@4.4.x (see here)

In most cases, running npm audit fix should be sufficient. You can also use npm update engine.io --depth=9999.

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

Thanks to Marcus Wejderot from Mevisio for the responsible disclosure.

Database specific 
{
    "cwe_ids": [
        "CWE-754",
        "CWE-755"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-12T19:26:23Z",
    "nvd_published_at": "2022-01-12T19:15:00Z",
    "severity": "HIGH"
}
References

Affected packages

npm / engine.io

Package

Name
engine.io
View open source insights on deps.dev
Purl
pkg:npm/engine.io

Affected ranges

Type
SEMVER
Events
Introduced
4.0.0
Fixed
4.1.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-273r-mgr4-v34f/GHSA-273r-mgr4-v34f.json"

npm / engine.io

Package

Name
engine.io
View open source insights on deps.dev
Purl
pkg:npm/engine.io

Affected ranges

Type
SEMVER
Events
Introduced
5.0.0
Fixed
5.2.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-273r-mgr4-v34f/GHSA-273r-mgr4-v34f.json"

npm / engine.io

Package

Name
engine.io
View open source insights on deps.dev
Purl
pkg:npm/engine.io

Affected ranges

Type
SEMVER
Events
Introduced
6.0.0
Fixed
6.1.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-273r-mgr4-v34f/GHSA-273r-mgr4-v34f.json"