GHSA-q9mw-68c2-j6m5

Suggest an improvement
Source
https://github.com/advisories/GHSA-q9mw-68c2-j6m5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-q9mw-68c2-j6m5/GHSA-q9mw-68c2-j6m5.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-q9mw-68c2-j6m5
Aliases
Published
2023-05-03T21:56:51Z
Modified
2023-11-08T04:12:29.393451Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
engine.io Uncaught Exception vulnerability
Details

Impact

A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.

TypeError: Cannot read properties of undefined (reading 'handlesUpgrades')
    at Server.onWebSocket (build/server.js:515:67)

This impacts all the users of the engine.io package, including those who uses depending packages like socket.io.

Patches

A fix has been released today (2023/05/02): 6.4.2

This bug was introduced in version 5.1.0 and included in version 4.1.0 of the socket.io parent package. Older versions are not impacted.

For socket.io users:

| Version range | engine.io version | Needs minor update? | |-----------------------------|---------------------|--------------------------------------------------------------------------------------------------------| | socket.io@4.6.x | ~6.4.0 | npm audit fix should be sufficient | | socket.io@4.5.x | ~6.2.0 | Please upgrade to socket.io@4.6.x | | socket.io@4.4.x | ~6.1.0 | Please upgrade to socket.io@4.6.x | | socket.io@4.3.x | ~6.0.0 | Please upgrade to socket.io@4.6.x | | socket.io@4.2.x | ~5.2.0 | Please upgrade to socket.io@4.6.x | | socket.io@4.1.x | ~5.1.1 | Please upgrade to socket.io@4.6.x | | socket.io@4.0.x | ~5.0.0 | Not impacted | | socket.io@3.1.x | ~4.1.0 | Not impacted | | socket.io@3.0.x | ~4.0.0 | Not impacted | | socket.io@2.5.0 | ~3.6.0 | Not impacted | | socket.io@2.4.x and below | ~3.5.0 | Not impacted |

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

Thanks to Thomas Rinsma from Codean for the responsible disclosure.

References

Affected packages

npm / engine.io

Package

Affected ranges

Type
SEMVER
Events
Introduced
5.1.0
Fixed
6.4.2