CVE-2023-31125

    Dashboard / Vulnerabilities / CVE-2023-31125

    CVE-2023-31125

    Published: 8 May 2023Last Modified: 12 Aug 2026

    Summary: Uncaught exception in engine.io

    Details: Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught exception vulnerability was introduced in version 5.1.0 and included in version 4.1.0 of the `socket.io` parent package. Older versions are not impacted. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the `engine.io` package, including those who use depending packages like `socket.io`. This issue was fixed in version 6.4.2 of Engine.IO. There is no known workaround except upgrading to a safe version.

    References: https://github.com/socketio/engine.io/releases/tag/6.4.2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31125.json, https://github.com/socketio/engine.io/security/advisories/GHSA-q9mw-68c2-j6m5, https://nvd.nist.gov/vuln/detail/CVE-2023-31125, https://security.netapp.com/advisory/ntap-20230622-0002/, https://github.com/socketio/engine.io/commit/fc480b4f305e16fe5972cf337d055e598372dc44

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 8c9bd9262f1c664722194c8c321cba947cf0bf54
    Fixed -95e215387c589025dde3982865bf8c862d049469

    Affected versions

    6.4.1
    6.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-31125 | CVE-DB