# engine.io (npm) vulnerabilities 7 known vulnerabilities (5 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 6.6.11 (Sep 24, 2026): no advisory affects it - Newest unaffected release: 6.6.11 (Sep 24, 2026), the latest release - Weekly downloads: 25.2M - Dependents: 16.2K - Releases: 161 since 0.1.0 (Jul 3, 2012) - Registry: https://www.npmjs.com/package/engine.io - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-102599: 6.6.0 to 6.6.9 (6.6.10 is outside it) - CVE-2026-59725: 4.1.0 to 6.6.6 (6.6.7 is outside it) - CVE-2026-59724: 6.5.0 to 6.6.6 (6.6.7 is outside it) - CVE-2023-31125: 5.1.0 to 6.4.1 (6.4.2 is outside it) - CVE-2022-41940: 0.1.0 to 3.6.0 (3.6.1 is outside it); 4.0.0 to 6.2.0 (6.2.1 is outside it) - CVE-2022-21676: 4.0.0 to 4.1.1 (4.1.2 is outside it); 5.0.0 to 5.2.0 (5.2.1 is outside it); 6.0.0 to 6.1.0 (6.1.1 is outside it) - CVE-2020-36048: 0.1.0 to 3.5.0 (3.6.0 is outside it) ## Advisories (7) ### [CVE-2026-102599](https://cve.now/CVE-2026-102599): Socket.IO: Engine.IO Protocol Revision Mismatch DoS - Severity: High 7.5 - Published: Oct 13, 2026 - Affected: from 6.6.0, fixed in 6.6.10. - Fixed in 6.6.10 (released Sep 3, 2026, 40 days before disclosure). - The latest release, 6.6.11, is not affected. - 42% of engine.io downloads last week were affected versions (12M). ### [CVE-2026-59725](https://cve.now/CVE-2026-59725): Socket.IO: Engine.IO Polling Transport Connection Exhaustion - Severity: High 7.5 - Published: Jul 8, 2026 - Affected: from 4.1.0, fixed in 6.6.7. - Fixed in 6.6.7 (released Apr 27, 2026, 72 days before disclosure). - The latest release, 6.6.11, is not affected. - 35% of engine.io downloads last week were affected versions (9.9M). ### [CVE-2026-59724](https://cve.now/CVE-2026-59724): Socket.IO: Engine.IO WebTransport SID DoS - Severity: High 7.5 - Published: Jul 8, 2026 - Affected: from 6.5.0, fixed in 6.6.7. - Fixed in 6.6.7 (released Apr 27, 2026, 72 days before disclosure). - The latest release, 6.6.11, is not affected. - 32% of engine.io downloads last week were affected versions (9M). ### [CVE-2023-31125](https://cve.now/CVE-2023-31125): Uncaught exception in engine.io - Severity: Medium 6.5 - Published: May 8, 2023 - Affected: from 5.1.0, fixed in 6.4.2. - Fixed in 6.4.2 (released May 1, 2023, 7 days before disclosure). - The latest release, 6.6.11, is not affected. - 2.1% of engine.io downloads last week were affected versions (596K). ### [CVE-2022-41940](https://cve.now/CVE-2022-41940): Uncaught exception in engine.io - Severity: High 7.1 - Published: Nov 22, 2022 - Affected: fixed in 3.6.1; from 4.0.0, fixed in 6.2.1. - Fixed in 3.6.1 (released Nov 20, 2022, 2 days before disclosure) and 6.2.1 (released Nov 20, 2022, 2 days before disclosure). - The latest release, 6.6.11, is not affected. - 6.7% of engine.io downloads last week were affected versions (1.9M). ### [CVE-2022-21676](https://cve.now/CVE-2022-21676): Uncaught Exception in engine.io - Severity: High 7.5 - Published: Jan 12, 2022 - Affected: from 4.0.0, fixed in 4.1.2; from 5.0.0, fixed in 5.2.1; from 6.0.0, fixed in 6.1.1. - Fixed in 4.1.2 (released Jan 11, 2022, 1 day before disclosure), 5.2.1 (released Jan 11, 2022, 1 day before disclosure) and 6.1.1 (released Jan 11, 2022, 1 day before disclosure). - The latest release, 6.6.11, is not affected. - 0.4% of engine.io downloads last week were affected versions (113.7K). ### [CVE-2020-36048](https://cve.now/CVE-2020-36048): Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling… - Severity: Unrated - Published: Jan 7, 2021 - Affected: fixed in 3.6.0. - Fixed in 3.6.0 (released Jun 6, 2022, 515 days after disclosure). - The latest release, 6.6.11, is not affected. - 4.5% of engine.io downloads last week were affected versions (1.3M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/engine.io Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.