engine.io vulnerabilities

2 known vulnerabilities in engine.io from Socketio. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  engine.io: Improper Resource Shutdown or Release

  CVE-2026-59725Jul 8, 2026Socketio

  Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-s

• 7.5 High severity

  engine.io: Improper Handling of Exceptional Conditions

  CVE-2022-21676Jan 12, 2022SocketioEPSS 2.85%

  Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This i