engine.io

The realtime engine behind Socket.IO. Provides the foundation of a bidirectional connection between client and server

Latest 6.6.11

NPM

88%

Total Score

healthy

Healthy release, supported by active maintenance, stable releases, and verified npm provenance.

Are you affected? Scan for Free

Health Score Breakdown

Repo package mention

The repository name does not match engine.io and its README does not mention the package, which creates some ownership ambiguity. The organization-backed Socket.IO repository partly compensates because this package is plausibly a monorepo component.

Repo tooling

The project uses Rollup, TypeScript, and Babel, but no security-scanning tools were detected; this is a modest transparency gap rather than a release blocker.

Workflow audit

All 14 workflows were analyzed with no untrusted checkouts or script injection, and most use read-only permissions. However, all 28 action references are unpinned, creating a supply-chain hygiene gap; the low-confidence cache-poisoning finding is not independently material.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-409534 engine.io is vulnerable to Denial of Service (DoS) in versions 6.6.0 - 6.6.9.	6.6.0 - 6.6.9	High
AIKIDO-2026-668170 engine.io is vulnerable to Denial of Service in versions 6.5.0 - 6.6.6.	6.5.0 - 6.6.6	High
AIKIDO-2026-770164 engine.io is vulnerable to Denial of Service in versions 4.1.0 - 6.6.6.	4.1.0 - 6.6.6	High
CVE-2023-31125 engine.io is vulnerable to Uncaught Exception in versions 5.1.0 - 6.4.2.	5.1.0 - 6.4.2	Medium
CVE-2022-41940 engine.io is vulnerable to Uncaught Exception in versions 0.0.0 - 3.6.1 and 4.0.0 - 6.2.1.	0.0.0 - 3.6.14.0.0 - 6.2.1	Medium