CVE-2020-36048
Resource exhaustion in engine.io
Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
- Record
CVE-2020-36048- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
- Record
CVE-2020-36048- Updated
- 2026-11-02
EUVDEUVD-2022-1064 No score
Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
- Record
EUVD-2022-1064- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j4f2-536g-r55m
Resource exhaustion in engine.io
Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
- Record
GHSA-j4f2-536g-r55m- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVAZL-44673
CVE-2020-36048 affecting package js-jquery 3.5.0-4
Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
- Record
AZL-44673- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
OSV
Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
- Record
CVE-2020-36048- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-j4f2-536g-r55m
Resource exhaustion in engine.io
Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
- Record
GHSA-j4f2-536g-r55m- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVCLSA-2026-1773015266 No score
TuxCare security update for engine.io (2 CVEs)
TuxCare rebuilt engine.io to address 2 CVEs. Fixed in 3.2.1-tuxcare.2.
- Record
CLSA-2026-1773015266- Updated
- 2026-11-02
OSVCLSA-2026-1776818202 No score
TuxCare security update for engine.io (2 CVEs)
TuxCare rebuilt engine.io to address 2 CVEs. Fixed in 3.1.5-tuxcare.1.
- Record
CLSA-2026-1776818202- Updated
- 2026-11-02
OSVCLSA-2026-1784856203 No score
TuxCare security update for engine.io (2 CVEs)
TuxCare rebuilt engine.io to address 2 CVEs. Fixed in 1.8.3-tuxcare.1.
- Record
CLSA-2026-1784856203- Updated
- 2026-11-02
OSVCLSA-2026-1792605582 No score
TuxCare security update for engine.io (2 CVEs)
TuxCare rebuilt engine.io to address 2 CVEs. Fixed in 1.8.5-tuxcare.1.
- Record
CLSA-2026-1792605582- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
engine.ionpm |
before 3.6.0 | 3.6.0 |
js-jqueryAzure Linux:3 |
through 3.5.0-4 | None known |
engine.ioTuxCare:npm From an advisory covering 2 CVEs |
3.2.1-tuxcare.0 up to 3.2.1-tuxcare.2, plus listed versions 3.2.13.2.1-tuxcare.1 |
3.2.1-tuxcare.2 |
engine.ioTuxCare:npm From an advisory covering 2 CVEs |
3.1.5-tuxcare.0 up to 3.1.5-tuxcare.1, plus listed versions 3.1.5 |
3.1.5-tuxcare.1 |
engine.ioTuxCare:npm From an advisory covering 2 CVEs |
1.8.3-tuxcare.0 up to 1.8.3-tuxcare.1, plus listed versions 1.8.3 |
1.8.3-tuxcare.1 |
engine.ioTuxCare:npm From an advisory covering 2 CVEs |
1.8.5-tuxcare.0 up to 1.8.5-tuxcare.1, plus listed versions 1.8.5 |
1.8.5-tuxcare.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-36048 is a high vulnerability (CVSS 7.5) in Socket Engine.io, published January 7, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.28%, the 88th percentile. Fixed in engine.io 3.6.0.
References
github.com/socketio/engine.io/commit/734f9d1268840722c41219e69eb58318e0b2ac6b
blog.caller.xyz/socketio-engineio-dos
nvd.nist.gov/vuln/detail/CVE-2020-36048