GHSA-q9mw-68c2-j6m5 engine.io Uncaught Exception vulnerability

• npm engine.io: >= 5.1.0, < 6.4.2 → fixed in 6.4.2

Impact A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. ``` TypeError: Cannot read properties of undefined (reading 'handlesUpgrades') at Server.onWebSocket (build/server.js:515:67) ``` This impacts all the users of the `engine.io` package, including those who uses depending packages like `socket.io`. Patches A fix has been released today (2023/05/02): 6.4.2 This bug was introduced in version 5.1.0 and included in version 4.1.0 of the `socket.io` parent package. Older versions are not impacted. For `socket.io` users: | Version range | `engine.io` version | Needs minor update? | |-----------------------------|---------------------|--------------------------------------------------------------------------------------------------------| | `[email protected]` | `~6.4.0` | `npm audit fix` should be sufficient | | `[email protected]` | `~6.2.0` | Please upgrade to `[email protected]` | | `[email protected]` | `~6.1.0` | Please upgrade to `[email protected]` | | `[email protected]` | `~6.0.0` | Please upgrade to `[email protected]` | | `[email protected]` | `~5.2.0` | Please upgrade to `[email protected]` | | `[email protected]` | `~5.1.1` | Please upgrade to `[email protected]` | | `[email protected]` | `~5.0.0` | Not impacted | | `[email protected]` | `~4.1.0` | Not impacted | | `[email protected]` | `~4.0.0` | Not impacted | | `[email protected]` | `~3.6.0` | Not impacted | | `[email protected]` and below | `~3.5.0` | Not impacted | Workarounds There is no known workaround except upgrading to a safe version. For more information If you have any questions or comments about this advisory: • Open an issue in `engine.io` Thanks to Thomas Rinsma from Codean for the responsible disclosure.