Insecure Defaults Allow MITM Over TLS in engine.io-client

Also known as GHSA-4r4m-hjwj-43p8

Published 8 y ago 2018-05-31 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.9

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.0%

percentile 63%

Public exploits

none known

engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the `rejectUnauthorized` setting. If the value is something that evaluates to false, certificate verification will be disabled. This is problematic as engine.io-client 1.6.8 and earlier passes in an object for settings that includes the rejectUnauthorized property, whether it has been set or not. If the value has not been explicitly changed, it will be passed in as `null`, resulting in certificate verification being turned off.

Exploit prediction (EPSS)

1.00% probability of exploitation in the next 30 days, higher than 63% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	5.9	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:P/I:N/A:N`
GitHub	3.0	5.9	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
npm	`engine.io-client`	<1.6.9	1.6.9

Affected products

HackerOne engine.io-client node module

Classification

Weakness

CWE-300 Channel Accessible by Non-Endpoint
CWE-295 Improper Certificate Validation

References

cigital.com /blog/node-js-socket-io/ · x_refsource_MISC, x_transferred
github.com /socketio/engine.io-client/commit/2c55b278a491bf45313ecc0825cf800e2f7ff5c1 · x_refsource_MISC, x_transferred
nodesecurity.io /advisories/99 · x_refsource_MISC, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-10536 · advisory
github.com /advisories/GHSA-4r4m-hjwj-43p8 · advisory
cigital.com /blog/node-js-socket-io · web
npmjs.com /advisories/99 · web

Sources

CVE List: CVE-2016-10536
GitHub Advisory: GHSA-4r4m-hjwj-43p8
NVD: CVE-2016-10536

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary