{"id":"CVE-2020-36048","aliases":["AZL-44673","CLSA-2026-1773015266","CLSA-2026-1776818202","CLSA-2026-1784856203","CLSA-2026-1792605582","EUVD-2022-1064","GHSA-j4f2-536g-r55m"],"status":"published","title":"Resource exhaustion in engine.io","description":"Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03276,"percentile":0.88512,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2021-01-07T23:24:33Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"engine.io","fixed_in":["3.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"engine.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"engine.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.1-tuxcare.0"},{"fixed":"3.2.1-tuxcare.2"}]}],"versions":["3.2.1","3.2.1-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"engine.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.5-tuxcare.0"},{"fixed":"3.1.5-tuxcare.1"}]}],"versions":["3.1.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"engine.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.3-tuxcare.0"},{"fixed":"1.8.3-tuxcare.1"}]}],"versions":["1.8.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"engine.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.5-tuxcare.0"},{"fixed":"1.8.5-tuxcare.1"}]}],"versions":["1.8.5"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"engine.io","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.0"}]}]}],"products":[{"vendor":"socket","product":"engine.io"}],"references":[{"url":"https://github.com/socketio/engine.io/commit/734f9d1268840722c41219e69eb58318e0b2ac6b","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://blog.caller.xyz/socketio-engineio-dos/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/bcaller/kill-engine-io","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36048","tags":["web","advisory"]},{"url":"https://github.com/socketio/engine.io/commit/58e274c437e9cbcf69fd913c813aad8fbd253703","tags":["web"]},{"url":"https://blog.caller.xyz/socketio-engineio-dos","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j4f2-536g-r55m"},{"url":"https://github.com/socketio/engine.io","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-36048","description":"Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.","status":"published","published":"2021-01-07T23:24:33Z","modified":"2024-08-04T17:16:14.103Z","updated_at":"2026-11-02T14:35:55.128961Z"}],"euvd":[{"id":"EUVD-2022-1064","description":"Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.","status":"published","published":"2021-01-07T23:24:33Z","modified":"2024-08-04T17:16:14Z","updated_at":"2026-11-03T03:07:04.065361Z"}],"ghsa":[{"id":"GHSA-j4f2-536g-r55m","title":"Resource exhaustion in engine.io","description":"Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.","status":"published","published":"2022-02-09T22:29:04Z","modified":"2025-05-29T23:06:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:38:45.948817Z"}],"nvd":[{"id":"CVE-2020-36048","description":"Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.","status":"published","published":"2021-01-08T00:15:11.093Z","modified":"2026-06-17T03:14:44.73Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:06:28.892872Z"}],"osv":[{"id":"AZL-44673","title":"CVE-2020-36048 affecting package js-jquery 3.5.0-4","description":"Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.","status":"published","published":"2021-01-08T00:15:11Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"CVE-2020-36048","description":"Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.","status":"published","published":"2021-01-08T00:15:11.093Z","modified":"2026-10-24T10:50:11.663354791Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"GHSA-j4f2-536g-r55m","title":"Resource exhaustion in engine.io","description":"Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.","status":"published","published":"2022-02-09T22:29:04Z","modified":"2025-05-29T23:06:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"CLSA-2026-1773015266","title":"TuxCare security update for engine.io (2 CVEs)","description":"TuxCare rebuilt engine.io to address 2 CVEs. Fixed in 3.2.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-15T09:47:34.849824818Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1776818202","title":"TuxCare security update for engine.io (2 CVEs)","description":"TuxCare rebuilt engine.io to address 2 CVEs. Fixed in 3.1.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:45:46.401016648Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1784856203","title":"TuxCare security update for engine.io (2 CVEs)","description":"TuxCare rebuilt engine.io to address 2 CVEs. Fixed in 1.8.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:54.817554072Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1792605582","title":"TuxCare security update for engine.io (2 CVEs)","description":"TuxCare rebuilt engine.io to address 2 CVEs. Fixed in 1.8.5-tuxcare.1.","status":"published","published":"2026-10-21T17:59:42Z","modified":"2026-10-21T20:30:49.901508204Z","updated_at":"2026-11-02T15:43:54.672859Z"}]}}