Cluster Engine
Monthly
Denial of service in Socket.IO Cluster Engine versions before 0.1.1 allows unauthenticated remote attackers to crash Node.js processes in clustered Socket.IO deployments by supplying crafted session IDs such as __proto__ or constructor. Only applications using @socket.io/cluster-engine are affected, and the flaw requires network reachability to the Socket.IO endpoint but no credentials or user interaction; the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H with base 7.5. No public exploit identified at time of analysis, and the issue is fixed in 0.1.1.
Denial of service in Socket.IO Cluster Engine versions before 0.1.1 allows unauthenticated remote attackers to crash Node.js processes in clustered Socket.IO deployments by supplying crafted session IDs such as __proto__ or constructor. Only applications using @socket.io/cluster-engine are affected, and the flaw requires network reachability to the Socket.IO endpoint but no credentials or user interaction; the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H with base 7.5. No public exploit identified at time of analysis, and the issue is fixed in 0.1.1.