CVE-2020-36048

HIGH7.5EPSS 0.50%

Resource exhaustion in engine.io

Published: 2/9/2022Modified: 5/29/2025

Description

Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.

Affected packages (1)

npm/engine.iofrom 0, < 3.6.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-36048
PATCHhttps://github.com/socketio/engine.io
WEBhttps://blog.caller.xyz/socketio-engineio-dos
WEBhttps://github.com/bcaller/kill-engine-io
WEBhttps://github.com/socketio/engine.io/commit/58e274c437e9cbcf69fd913c813aad8fbd253703
WEBhttps://github.com/socketio/engine.io/commit/734f9d1268840722c41219e69eb58318e0b2ac6b