CVE-2022-41940

Katalog CVE

CVSS 6.5 · Medium EPSS 2,1%

Kerentanan Uncaught Exception pada socket engine.io. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.

Rincian

Terbit di NVD

22 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-248: Uncaught Exception

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 80,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6 patch · advisory pihak ketiga
• https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085 patch · advisory pihak ketiga
• https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w exploit · advisory pihak ketiga