| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| engine.io | ≥ 5.1.0, < 6.4.2 | 6.4.2 |
| engine.io | ≥ 5.1.0, < 6.4.2 | 6.4.2 |
A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.
TypeError: Cannot read properties of undefined (reading 'handlesUpgrades')
at Server.onWebSocket (build/server.js:515:67)
This impacts all the users of the engine.io package, including those who uses depending packages like socket.io.
A fix has been released today (2023/05/02): 6.4.2
This bug was introduced in version 5.1.0 and included in version 4.1.0 of the socket.io parent package. Older versions are not impacted.
For socket.io users:
| Version range | engine.io version | Needs minor update? |
|---|---|---|
[email protected] | ~6.4.0 | npm audit fix should be sufficient |
[email protected] | ~6.2.0 | Please upgrade to [email protected] |
[email protected] | ~6.1.0 | Please upgrade to [email protected] |
[email protected] | ~6.0.0 | Please upgrade to [email protected] |
[email protected] | ~5.2.0 | Please upgrade to [email protected] |
[email protected] | ~5.1.1 | Please upgrade to [email protected] |
[email protected] | ~5.0.0 | Not impacted |
[email protected] | ~4.1.0 | Not impacted |
[email protected] | ~4.0.0 | Not impacted |
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí[email protected] |
~3.6.0 |
| Not impacted |
[email protected] and below | ~3.5.0 | Not impacted |
There is no known workaround except upgrading to a safe version.
If you have any questions or comments about this advisory:
engine.ioThanks to Thomas Rinsma from Codean for the responsible disclosure.