GHSA-j4f2-536g-r55m

Resource exhaustion in engine.io

Source: GitHub Advisory Database (reviewed) High CVE-2020-36048

Packages

Ecosystem	Package	Affected	Fixed in
npm	engine.io	< 3.6.0	3.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-36048 advisory
https://github.com/socketio/engine.io/commit/58e274c437e9cbcf69fd913c813aad8fbd253703 web
https://github.com/socketio/engine.io/commit/734f9d1268840722c41219e69eb58318e0b2ac6b web
https://blog.caller.xyz/socketio-engineio-dos web
https://github.com/bcaller/kill-engine-io web
https://github.com/socketio/engine.io package