Socket.IO: Engine.IO Protocol Revision Mismatch DoSGHSA-2gc4-cqfq-p2gv
HIGHFix: socketio/socket.io@86db1fcGHSA-2gc4-cqfq-p2gv is a high-severity (CVSS 7.5) CWE-248 vulnerability in engine.io. A fix is available for engine.io — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-2gc4-cqfq-p2gv.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-2gc4-cqfq-p2gv by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 394,803 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
engine.ionpmDescription
Impact
A denial-of-service vulnerability exists in Engine.IO / Socket.IO servers that allow transport upgrades.
The Engine.IO protocol revision is negotiated during the initial handshake and stored on the session, but a newly-created transport, including a WebSocket upgrade transport, could independently derive a different protocol revision from the upgrade request query parameters. The server did not verify that the protocol revision of an upgrade request matched the protocol revision of the existing session.
A malicious client could exploit this mismatch by establishing a valid Engine.IO session and then sending an upgrade request with a different, or omitted, EIO query parameter. This could cause the server to attach a transport using a parser and heartbeat behavior inconsistent with the session. Under some conditions, a crafted heartbeat packet could trigger an uncaught exception and terminate the Node.js process.
Servers using the default Engine.IO v4 protocol are impacted. The issue can be triggered even when Engine.IO v3 compatibility is disabled, because an omitted EIO parameter is interpreted as protocol v3 on the affected transport path.
The impact is denial of service through process crash.
Affected versions:
engine.io >= 6.6.0, < 6.6.10
Patches
The issue was fixed in:
- engine.io 6.6.10
Users should upgrade to [email protected] or later.
If using Socket.IO packages that depend on Engine.IO, users should update to a Socket.IO release that includes the patched Engine.IO version.
Workarounds
If upgrading is not immediately possible, users can reduce exposure by disabling transport upgrades:
const io = new Server(httpServer, {
allowUpgrades: false
});
or by allowing only a single transport, for example WebSocket only:
const io = new Server(httpServer, {
transports: ["websocket"]
});
These mitigations avoid the vulnerable upgrade path, but they may affect client compatibility and connection behavior.
As an additional temporary mitigation, deployments may reject Engine.IO requests for an existing sid when the EIO query parameter is missing or does not match the protocol revision used during the initial handshake. This is best done at the application proxy or middleware layer only if the deployment can reliably track the session’s negotiated protocol.
Upgrading remains the recommended fix.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | engine.io | ≥ 6.6.0&&< 6.6.10 | 6.6.10npm install engine.io@6.6.10 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for engine.io, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update engine.io to 6.6.10 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-2gc4-cqfq-p2gv is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
A flaw of IMPORTANT impact was found in the Engine.IO transport layer of Socket.IO. A remote, unauthenticated attacker can establish a valid Engine.IO session and then send a transport upgrade request with a mismatched or omitted EIO protocol revision parameter. Because the server derives the protocol revision for the…
Upgrading to an engine.io release that contains the fix (engine.io 6.6.10 or later, or a Socket.IO release that bundles it) is the recommended resolution. Where upgrading is not immediately possible, upstream documents workarounds that avoid the vulnerable transport-upgrade path: disable transport upgrades by setting allowUpgrades: false in the Socket.IO server options, or restrict the server to a single transport such as WebSocket-only via transports: ["websocket"]. Note that these options may affect client compatibility and connection behavior. As an additional temporary measure, deployments can reject Engine.IO requests for an existing session (sid) when the EIO query parameter is…Source: Red Hat security advisory for GHSA-2gc4-cqfq-p2gv (CC BY 4.0)
Frequently Asked Questions
Is GHSA-2gc4-cqfq-p2gv in your dependencies?
Find it across npm, including transitive dependencies.