npmPackage

engine.io

7 known vulnerabilities (5 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: 6.6.11 (Sep 24, 2026): no advisory affects it
Newest unaffected release: 6.6.11 (Sep 24, 2026), the latest release
Advisories: 7 · 5 high, 1 medium

Weekly downloads: 25.2M
Dependents: 16.2K
Releases: 161 since 0.1.0 (Jul 3, 2012)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-102599
Affects 6.6.0 to 6.6.9 (6.6.10 is outside it)
CVE-2026-59725
Affects 4.1.0 to 6.6.6 (6.6.7 is outside it)
CVE-2026-59724
Affects 6.5.0 to 6.6.6 (6.6.7 is outside it)
CVE-2023-31125
Affects 5.1.0 to 6.4.1 (6.4.2 is outside it)
CVE-2022-41940
Affects 0.1.0 to 3.6.0 (3.6.1 is outside it); 4.0.0 to 6.2.0 (6.2.1 is outside it)
CVE-2022-21676
Affects 4.0.0 to 4.1.1 (4.1.2 is outside it); 5.0.0 to 5.2.0 (5.2.1 is outside it); 6.0.0 to 6.1.0 (6.1.1 is outside it)
CVE-2020-36048
Affects 0.1.0 to 3.5.0 (3.6.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

CVE-2026-102599High 7.5
Socket.IO: Engine.IO Protocol Revision Mismatch DoS
Affected: from 6.6.0, fixed in 6.6.10.
Fixed in 6.6.10 (released Sep 3, 2026, 40 days before disclosure).
The latest release, 6.6.11, is not affected.
42% of engine.io downloads last week were affected versions (12M).
CVE-2026-59725High 7.5
Socket.IO: Engine.IO Polling Transport Connection Exhaustion
Affected: from 4.1.0, fixed in 6.6.7.
Fixed in 6.6.7 (released Apr 27, 2026, 72 days before disclosure).
The latest release, 6.6.11, is not affected.
35% of engine.io downloads last week were affected versions (9.9M).
CVE-2026-59724High 7.5
Socket.IO: Engine.IO WebTransport SID DoS
Affected: from 6.5.0, fixed in 6.6.7.
Fixed in 6.6.7 (released Apr 27, 2026, 72 days before disclosure).
The latest release, 6.6.11, is not affected.
32% of engine.io downloads last week were affected versions (9M).
CVE-2023-31125Medium 6.5
Uncaught exception in engine.io
Affected: from 5.1.0, fixed in 6.4.2.
Fixed in 6.4.2 (released May 1, 2023, 7 days before disclosure).
The latest release, 6.6.11, is not affected.
2.1% of engine.io downloads last week were affected versions (596K).
CVE-2022-41940High 7.1
Uncaught exception in engine.io
Affected: fixed in 3.6.1; from 4.0.0, fixed in 6.2.1.
Fixed in 3.6.1 (released Nov 20, 2022, 2 days before disclosure) and 6.2.1 (released Nov 20, 2022, 2 days before disclosure).
The latest release, 6.6.11, is not affected.
6.7% of engine.io downloads last week were affected versions (1.9M).
CVE-2022-21676High 7.5
Uncaught Exception in engine.io
Affected: from 4.0.0, fixed in 4.1.2; from 5.0.0, fixed in 5.2.1; from 6.0.0, fixed in 6.1.1.
Fixed in 4.1.2 (released Jan 11, 2022, 1 day before disclosure), 5.2.1 (released Jan 11, 2022, 1 day before disclosure) and 6.1.1 (released Jan 11, 2022, 1 day before disclosure).
The latest release, 6.6.11, is not affected.
0.4% of engine.io downloads last week were affected versions (113.7K).
CVE-2020-36048Unrated
Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling…
Affected: fixed in 3.6.0.
Fixed in 3.6.0 (released Jun 6, 2022, 515 days after disclosure).
The latest release, 6.6.11, is not affected.
4.5% of engine.io downloads last week were affected versions (1.3M).