Prototype Pollutionengine.io is a realtime engine behind Socket.IO. It provides the foundation of a bidirectional connection between client and server
Affected versions of this package are vulnerable to Prototype Pollution through the WebTransport upgrade handling in packages/engine.io/lib/server.ts. An attacker can crash the server by sending a crafted unauthenticated WebTransport upgrade request with a session ID such as __proto__, which the lookup resolves through the clients object’s prototype chain instead of rejecting as invalid. When this path processes a non-own SID, it raises a TypeError during WebTransport handshake handling; in affected Node.js configurations, this can manifest as an unhandled Promise rejection, terminating the process. The result is a remote service outage affecting deployments with WebTransport enabled.
Notes
- WebTransport is opt-in in Engine.IO; deployments that only use the default polling/WebSocket transports are not exposed to this crash path.
- The crash is triggered during the upgrade handshake by a session ID value carried in the WebTransport packet payload, so setups that front Engine.IO with a proxy or HTTP/3/WebTransport gate can avoid the vulnerable code path if that traffic never reaches the server.
Workarounds
- Disable WebTransport support by ensuring
webtransport is not included in the enabled transports list; for example, configure transports: ["polling", "websocket"] to prevent the unauthenticated WebTransport upgrade DoS path.
- If immediate upgrade is not possible, restrict access to WebTransport endpoints at the reverse proxy or HTTP/3 layer to limit who can send the malicious upgrade request.
- Disable HTTP/3/WebTransport support until
engine.io@6.6.7 or later is deployed to block the vulnerable upgrade handling entirely.
- Run the service under a supervisor as a partial availability mitigation so repeated crash attempts can be restarted, though this does not prevent the attack itself.
How to fix Prototype Pollution? Upgrade engine.io to version 6.6.7 or higher.
| |
Improper Resource Shutdown or Releaseengine.io is a realtime engine behind Socket.IO. It provides the foundation of a bidirectional connection between client and server
Affected versions of this package are vulnerable to Improper Resource Shutdown or Release through the polling request handler in Polling transport processing. An attacker can consume server-side sockets and related HTTP resources by sending an invalid Engine.IO v4 polling POST request with Content-Type: application/octet-stream after establishing a polling session. The vulnerable code reports invalid content but leaves the HTTP response open, so repeated malformed requests can accumulate unfinished connections. This can prevent legitimate clients from connecting and exhaust available file descriptors or connection slots on the server.
Notes
- The vulnerable path is limited to Engine.IO protocol v4 polling
POST requests that present Content-Type: application/octet-stream; other polling traffic is not in scope for this issue.
Workarounds
- Block or reject Engine.IO protocol v4 polling
POST requests with Content-Type: application/octet-stream at a reverse proxy, load balancer, WAF, or application middleware to prevent the malformed request path that can leave HTTP connections open and consume sockets/resources.
- Disable HTTP long-polling and use WebSocket-only transport if your deployment and clients support it to prevent exposure of the vulnerable polling handler.
- Enforce strict request and connection timeouts at the HTTP server, reverse proxy, or load balancer to limit how long malformed polling requests can hold server-side connections open.
- Apply per-IP rate limits and connection limits for Engine.IO endpoints to reduce the ability to repeat the crafted polling requests and exhaust server resources.
- Restrict access to the Socket.IO/Engine.IO endpoint where feasible to limit who can reach the vulnerable polling transport.
How to fix Improper Resource Shutdown or Release? Upgrade engine.io to version 6.6.7 or higher.
| |
