AIKIDO-2026-770164
engine.io is vulnerable to Denial of Service
75
High Risk
This Affects:
engine.ioTL;DR
An unauthenticated remote attacker can cause a denial of service in affected versions of engine.io by opening Engine.IO polling sessions and sending an invalid binary POST request with: Content-Type: application/octet-stream against an Engine.IO protocol v4 polling transport. In the vulnerable code path, the server reports a transport error but does not properly close the HTTP response associated with the malformed request. As a result, the underlying HTTP connection may remain open, consuming one server-side socket/resource per crafted request. An attacker can repeat this with many sessions to exhaust available HTTP connections, sockets, file descriptors, or related server resources, potentially preventing legitimate clients from connecting.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
engine.io is vulnerable to Denial of Service in versions 4.1.0 - 6.6.6.
How to fix this
Upgrade the engine.io library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant