Resource exhaustion in engine.io

HIGH 7.5CVE-2020-36048 · GHSA-j4f2-536g-r55m · Published 08/01/2021 · updated 17/06/2026

In short

CVE-2020-36048 is a HIGH (CVSS 7.5) vulnerability affecting engine.io (socket), engine.io.
Chance of exploitation in the next 30 days (EPSS): 3.3%, higher than 88.4% of all vulnerabilities.
Fix: update to 4.0.0, 3.6.0 or later.

Package	Affected versions	Patched versions
engine.io socket	`< 4.0.0`	`4.0.0`
engine.io npm	`< 3.6.0`	`3.6.0`

Description

Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.

NVD description

Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.

References

nvd.nist.gov/vuln/detail/CVE-2020-36048 · ADVISORY
socketio/engine.io commit 58e274c · WEB
socketio/engine.io commit 734f9d1 · WEB
blog.caller.xyz/socketio-engineio-dos · WEB
bcaller/kill-engine-io · WEB
socketio/engine.io · PACKAGE
blog.caller.xyz/socketio-engineio-dos · Exploit

More vulnerabilities in engine.io

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

engine.io

socket

< 4.0.0

4.0.0

engine.io

npm

< 3.6.0

3.6.0

Description

Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.

NVD description

Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.

More vulnerabilities in engine.io

See all →