Improper Resource Shutdown or Release Affecting engine.io package, versions >=4.1.0 <6.6.7

engine.io is a realtime engine behind Socket.IO. It provides the foundation of a bidirectional connection between client and server

Affected versions of this package are vulnerable to Improper Resource Shutdown or Release through the polling request handler in Polling transport processing. An attacker can consume server-side sockets and related HTTP resources by sending an invalid Engine.IO v4 polling POST request with Content-Type: application/octet-stream after establishing a polling session. The vulnerable code reports invalid content but leaves the HTTP response open, so repeated malformed requests can accumulate unfinished connections. This can prevent legitimate clients from connecting and exhaust available file descriptors or connection slots on the server.

Notes

• The vulnerable path is limited to Engine.IO protocol v4 polling POST requests that present Content-Type: application/octet-stream; other polling traffic is not in scope for this issue.

Workarounds

• Block or reject Engine.IO protocol v4 polling POST requests with Content-Type: application/octet-stream at a reverse proxy, load balancer, WAF, or application middleware to prevent the malformed request path that can leave HTTP connections open and consume sockets/resources.
• Disable HTTP long-polling and use WebSocket-only transport if your deployment and clients support it to prevent exposure of the vulnerable polling handler.
• Enforce strict request and connection timeouts at the HTTP server, reverse proxy, or load balancer to limit how long malformed polling requests can hold server-side connections open.
• Apply per-IP rate limits and connection limits for Engine.IO endpoints to reduce the ability to repeat the crafted polling requests and exhaust server resources.
• Restrict access to the Socket.IO/Engine.IO endpoint where feasible to limit who can reach the vulnerable polling transport.

• GitHub Commit
• Maintainer's Advisory