AIKIDO-2026-409534

TL;DR

Engine.IO computes each transport's protocol revision independently from the request query instead of checking it against the revision already pinned on the session at handshake. A client holding a valid session can send a transport upgrade request, including a WebSocket upgrade, with a different or missing EIO query parameter, attaching a transport whose parser and heartbeat behavior no longer matches the session state, even with Engine.IO v3 compatibility disabled. A crafted heartbeat packet on that mismatched transport can then reach an unguarded timer reference and throw an uncaught exception that terminates the Node.js process. The fix records the protocol revision on the session and rejects any upgrade request whose derived revision does not match it.