https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 10:06:19 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-102599 <p>Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10.</p> <p>Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10.</p> https://db.gcve.eu/vuln/fkie_cve-2026-102599 https://db.gcve.eu/vuln/ghsa-2gc4-cqfq-p2gv <p><strong>Affected:</strong> npm: engine.io</p> <p>### Impact</p> <p>A denial-of-service vulnerability exists in Engine.IO / Socket.IO servers that allow transport upgrades.</p> <p>The Engine.IO protocol revision is negotiated during the initial handshake and stored on the session, but a newly-created transport, including a WebSocket upgrade transport, could independently derive a different protocol revision from the upgrade request query parameters. The server did not verify that the protocol revision of an upgrade request matched the protocol revision of the existing session.</p> <p>A malicious client could exploit this mismatch by establishing a valid Engine.IO session and then sending an upgrade request with a different, or omitted, `EIO` query parameter. This could cause the server to attach a transport using a parser and heartbeat behavior inconsistent with the session. Under some conditions, a crafted heartbeat packet could trigger an uncaught exception and terminate the Node.js process.</p> <p>Servers using the default Engine.IO v4 protocol are impacted. The issue can be triggered even when Engine.IO v3 compatibility is disabled, because an omitted `EIO` parameter is interpreted as protocol v3 on the affected transport path.</p> <p>The impact is **denial of service** through process crash.</p> <p>Affected versions:</p> <p>- `engine.io &gt;= 6.6.0, &lt; 6.6.10`</p> <p>## Patches</p> <p>The issue was fixed in:</p> <p>- **engine.io 6.6.10**</p> <p>Users should upgrade to `engine.io@6.6.10` or later.</p> <p>If using Socket.IO packages that depend on Engine.IO, users should update to a Socket.IO re…</p> <p><strong>Affected:</strong> npm: engine.io</p> <p>### Impact</p> <p>A denial-of-service vulnerability exists in Engine.IO / Socket.IO servers that allow transport upgrades.</p> <p>The Engine.IO protocol revision is negotiated during the initial handshake and stored on the session, but a newly-created transport, including a WebSocket upgrade transport, could independently derive a different protocol revision from the upgrade request query parameters. The server did not verify that the protocol revision of an upgrade request matched the protocol revision of the existing session.</p> <p>A malicious client could exploit this mismatch by establishing a valid Engine.IO session and then sending an upgrade request with a different, or omitted, `EIO` query parameter. This could cause the server to attach a transport using a parser and heartbeat behavior inconsistent with the session. Under some conditions, a crafted heartbeat packet could trigger an uncaught exception and terminate the Node.js process.</p> <p>Servers using the default Engine.IO v4 protocol are impacted. The issue can be triggered even when Engine.IO v3 compatibility is disabled, because an omitted `EIO` parameter is interpreted as protocol v3 on the affected transport path.</p> <p>The impact is **denial of service** through process crash.</p> <p>Affected versions:</p> <p>- `engine.io &gt;= 6.6.0, &lt; 6.6.10`</p> <p>## Patches</p> <p>The issue was fixed in:</p> <p>- **engine.io 6.6.10**</p> <p>Users should upgrade to `engine.io@6.6.10` or later.</p> <p>If using Socket.IO packages that depend on Engine.IO, users should update to a Socket.IO re…</p> https://db.gcve.eu/vuln/ghsa-2gc4-cqfq-p2gv