{"id":"CVE-2022-41940","aliases":["AZL-44820","CLSA-2026-1773015266","CLSA-2026-1776818202","CLSA-2026-1784856203","CLSA-2026-1792605466","CLSA-2026-1792605582","EUVD-2022-7419","GHSA-r7qp-cfhv-p84w","ROOT-APP-NPM-CVE-2022-41940"],"status":"published","title":"Uncaught exception in engine.io","description":"Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0211,"percentile":0.81924,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248"],"published":"2022-11-21T23:55:41Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"engine.io","fixed_in":["3.6.1","6.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"@rootio/engine.io","fixed_in":["4.1.2-root.io.1","4.1.2-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"engine.io","fixed_in":["4.1.2-aikido.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"engine.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"engine.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"6.2.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"engine.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.1-tuxcare.0"},{"fixed":"3.2.1-tuxcare.2"}]}],"versions":["3.2.1","3.2.1-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"engine.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.5-tuxcare.0"},{"fixed":"3.1.5-tuxcare.1"}]}],"versions":["3.1.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"engine.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.3-tuxcare.0"},{"fixed":"1.8.3-tuxcare.1"}]}],"versions":["1.8.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"engine.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.2-tuxcare.0"},{"fixed":"4.1.2-tuxcare.1"}]}],"versions":["4.1.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"engine.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.5-tuxcare.0"},{"fixed":"1.8.5-tuxcare.1"}]}],"versions":["1.8.5"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"engine.io","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.1"}]}]},{"source":"osv","ecosystem":"npm","package":"engine.io","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"6.2.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/engine.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-root.io.1"},{"fixed":"4.1.2-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"engine.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-aikido.2"}]}]}],"products":[{"vendor":"socket","product":"engine.io"},{"vendor":"socketio","product":"engine.io"}],"references":[{"url":"https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w","tags":["x_transferred","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41940","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-r7qp-cfhv-p84w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41940.json","tags":["advisory"]},{"url":"https://github.com/socketio/engine.io","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-41940","title":"Uncaught exception in engine.io ","description":"Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.","status":"published","published":"2022-11-22T00:00:00Z","modified":"2025-04-22T16:02:20.459Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:34:28.038197Z"}],"euvd":[{"id":"EUVD-2022-7419","description":"Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.","status":"published","published":"2022-11-22T00:00:00Z","modified":"2025-04-22T16:02:20Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:16.784071Z"}],"ghsa":[{"id":"GHSA-r7qp-cfhv-p84w","title":"Uncaught exception in engine.io","description":"### Impact\n\nA specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.\n\n```\nevents.js:292\n throw er; // Unhandled 'error' event\n ^\n\nError: read ECONNRESET\n at TCP.onStreamRead (internal/stream_base_commons.js:209:20)\nEmitted 'error' event on Socket instance at:\n at emitErrorNT (internal/streams/destroy.js:106:8)\n at emitErrorCloseNT (internal/streams/destroy.js:74:3)\n at processTicksAndRejections (internal/process/task_queues.js:80:21) {\n errno: -104,\n code: 'ECONNRESET',\n syscall: 'read'\n}\n```\n\nThis impacts all the users of the [`engine.io`](https://www.npmjs.com/package/engine.io) package, including those who uses depending packages like [`socket.io`](https://www.npmjs.com/package/socket.io).\n\n### Patches\n\nA fix has been released today (2022/11/20):\n\n| Version range | Fixed version |\n|-------------------|---------------|\n| `engine.io@3.x.y` | `3.6.1` |\n| `engine.io@6.x.y` | `6.2.1` |\n\nFor `socket.io` users:\n\n| Version range | `engine.io` version | Needs minor update? |\n|-----------------------------|---------------------|--------------------------------------------------------------------------------------------------------|\n| `socket.io@4.5.x` | `~6.2.0` | `npm audit fix` should be sufficient |\n| `socket.io@4.4.x` | `~6.1.0` | Please upgrade to `socket.io@4.5.x` |\n| `socket.io@4.3.x` | `~6.0.0` | Please upgrade to `socket.io@4.5.x` |\n| `socket.io@4.2.x` | `~5.2.0` | Please upgrade to `socket.io@4.5.x` |\n| `socket.io@4.1.x` | `~5.1.1` | Please upgrade to `socket.io@4.5.x` |\n| `socket.io@4.0.x` | `~5.0.0` | Please upgrade to `socket.io@4.5.x` |\n| `socket.io@3.1.x` | `~4.1.0` | Please upgrade to `socket.io@4.5.x` (see [here](https://socket.io/docs/v4/migrating-from-3-x-to-4-0/)) |\n| `socket.io@3.0.x` | `~4.0.0` | Please upgrade to `socket.io@4.5.x` (see [here](https://socket.io/docs/v4/migrating-from-3-x-to-4-0/)) |\n| `socket.io@2.5.0` | `~3.6.0` | `npm audit fix` should be sufficient |\n| `socket.io@2.4.x` and below | `~3.5.0` | Please upgrade to `socket.io@2.5.0` |\n\n### Workarounds\n\nThere is no known workaround except upgrading to a safe version.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [`engine.io`](https://github.com/socketio/engine.io)\n\nThanks to [Jonathan Neve](https://github.com/jonathanneve) for the responsible disclosure.\n","status":"published","published":"2022-11-21T23:55:41Z","modified":"2023-02-01T05:03:21Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:36:31.364752Z"}],"nvd":[{"id":"CVE-2022-41940","description":"Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.","status":"published","published":"2022-11-22T01:15:37.847Z","modified":"2026-06-17T05:04:06.203Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:07:32.395456Z"}],"osv":[{"id":"AZL-44820","title":"CVE-2022-41940 affecting package js-jquery 3.5.0-4","description":"Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.","status":"published","published":"2022-11-22T01:15:37Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"CVE-2022-41940","title":"Uncaught exception in engine.io ","description":"Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.","status":"published","published":"2022-11-22T00:00:00Z","modified":"2026-10-28T02:30:48.153723304Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:44:27.186787Z"},{"id":"GHSA-r7qp-cfhv-p84w","title":"Uncaught exception in engine.io","description":"### Impact\n\nA specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.\n\n```\nevents.js:292\n throw er; // Unhandled 'error' event\n ^\n\nError: read ECONNRESET\n at TCP.onStreamRead (internal/stream_base_commons.js:209:20)\nEmitted 'error' event on Socket instance at:\n at emitErrorNT (internal/streams/destroy.js:106:8)\n at emitErrorCloseNT (internal/streams/destroy.js:74:3)\n at processTicksAndRejections (internal/process/task_queues.js:80:21) {\n errno: -104,\n code: 'ECONNRESET',\n syscall: 'read'\n}\n```\n\nThis impacts all the users of the [`engine.io`](https://www.npmjs.com/package/engine.io) package, including those who uses depending packages like [`socket.io`](https://www.npmjs.com/package/socket.io).\n\n### Patches\n\nA fix has been released today (2022/11/20):\n\n| Version range | Fixed version |\n|-------------------|---------------|\n| `engine.io@3.x.y` | `3.6.1` |\n| `engine.io@6.x.y` | `6.2.1` |\n\nFor `socket.io` users:\n\n| Version range | `engine.io` version | Needs minor update? |\n|-----------------------------|---------------------|--------------------------------------------------------------------------------------------------------|\n| `socket.io@4.5.x` | `~6.2.0` | `npm audit fix` should be sufficient |\n| `socket.io@4.4.x` | `~6.1.0` | Please upgrade to `socket.io@4.5.x` |\n| `socket.io@4.3.x` | `~6.0.0` | Please upgrade to `socket.io@4.5.x` |\n| `socket.io@4.2.x` | `~5.2.0` | Please upgrade to `socket.io@4.5.x` |\n| `socket.io@4.1.x` | `~5.1.1` | Please upgrade to `socket.io@4.5.x` |\n| `socket.io@4.0.x` | `~5.0.0` | Please upgrade to `socket.io@4.5.x` |\n| `socket.io@3.1.x` | `~4.1.0` | Please upgrade to `socket.io@4.5.x` (see [here](https://socket.io/docs/v4/migrating-from-3-x-to-4-0/)) |\n| `socket.io@3.0.x` | `~4.0.0` | Please upgrade to `socket.io@4.5.x` (see [here](https://socket.io/docs/v4/migrating-from-3-x-to-4-0/)) |\n| `socket.io@2.5.0` | `~3.6.0` | `npm audit fix` should be sufficient |\n| `socket.io@2.4.x` and below | `~3.5.0` | Please upgrade to `socket.io@2.5.0` |\n\n### Workarounds\n\nThere is no known workaround except upgrading to a safe version.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [`engine.io`](https://github.com/socketio/engine.io)\n\nThanks to [Jonathan Neve](https://github.com/jonathanneve) for the responsible disclosure.\n","status":"published","published":"2022-11-21T23:55:41Z","modified":"2023-11-08T04:10:36.669362Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"CLSA-2026-1773015266","title":"TuxCare security update for engine.io (2 CVEs)","description":"TuxCare rebuilt engine.io to address 2 CVEs. Fixed in 3.2.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-15T09:47:34.849824818Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1776818202","title":"TuxCare security update for engine.io (2 CVEs)","description":"TuxCare rebuilt engine.io to address 2 CVEs. Fixed in 3.1.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:45:46.401016648Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1784856203","title":"TuxCare security update for engine.io (2 CVEs)","description":"TuxCare rebuilt engine.io to address 2 CVEs. Fixed in 1.8.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:54.817554072Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1792605466","title":"TuxCare security update for engine.io (2 CVEs)","description":"TuxCare rebuilt engine.io to address 2 CVEs. Fixed in 4.1.2-tuxcare.1.","status":"published","published":"2026-10-21T17:57:46Z","modified":"2026-10-21T20:30:50.498425088Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792605582","title":"TuxCare security update for engine.io (2 CVEs)","description":"TuxCare rebuilt engine.io to address 2 CVEs. Fixed in 1.8.5-tuxcare.1.","status":"published","published":"2026-10-21T17:59:42Z","modified":"2026-10-21T20:30:49.901508204Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"ROOT-APP-NPM-CVE-2022-41940","title":"CVE-2022-41940 in @rootio/engine.io - Patched by Root","description":"Root has patched CVE-2022-41940 in the @rootio/engine.io package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-04T19:40:57Z","modified":"2026-06-05T01:30:28.723295305Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}