CVE-2022-41940

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.

• CWE-248

• https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6Patch, Third Party Advisory
• https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085Patch, Third Party Advisory
• https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84wExploit, Third Party Advisory
• https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6Patch, Third Party Advisory
• https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085Patch, Third Party Advisory
• https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84wExploit, Third Party Advisory

Published

Nov 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-41935XWiki Platform is a generic wiki platform offering runtime s…4.3
• CVE-2022-41936XWiki Platform is a generic wiki platform offering runtime s…7.5
• CVE-2022-41937XWiki Platform is a generic wiki platform offering runtime s…8.1
• CVE-2022-41938Flarum is an open source discussion platform. Flarum's page …5.4
• CVE-2022-41939knative.dev/func is is a client library and CLI enabling the…7.4
• CVE-2022-4194Use after free in Accessibility in Google Chrome prior to 10…8.8
• CVE-2022-41941GLPI is a Free Asset and IT Management Software package. Ver…4.8
• CVE-2022-41942Sourcegraph is a code intelligence platform. In versions pri…7.8
• CVE-2022-41943sourcegraph is a code intelligence platform. As a site admin…7.2
• CVE-2022-41944Discourse is an open-source discussion platform. In stable v…4.3
• CVE-2022-41945super-xray is a vulnerability scanner (xray) GUI launcher. I…9.8
• CVE-2022-41946pgjdbc is an open source postgresql JDBC Driver. In affected…5.5