Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-qutm-ax5s-jfeh
Vulnerability ID VCID-qutm-ax5s-jfeh
Aliases CVE-2023-31125
GHSA-q9mw-68c2-j6m5
Summary Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught exception vulnerability was introduced in version 5.1.0 and included in version 4.1.0 of the `socket.io` parent package. Older versions are not impacted. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the `engine.io` package, including those who use depending packages like `socket.io`. This issue was fixed in version 6.4.2 of Engine.IO. There is no known workaround except upgrading to a safe version.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-248 Uncaught Exception
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-31125.json
epss 0.01086 https://api.first.org/data/v1/epss?cve=CVE-2023-31125
epss 0.01086 https://api.first.org/data/v1/epss?cve=CVE-2023-31125
epss 0.01086 https://api.first.org/data/v1/epss?cve=CVE-2023-31125
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-q9mw-68c2-j6m5
cvssv3.1 6.5 https://github.com/socketio/engine.io
generic_textual MODERATE https://github.com/socketio/engine.io
cvssv3.1 6.5 https://github.com/socketio/engine.io/commit/fc480b4f305e16fe5972cf337d055e598372dc44
generic_textual MODERATE https://github.com/socketio/engine.io/commit/fc480b4f305e16fe5972cf337d055e598372dc44
ssvc Track https://github.com/socketio/engine.io/commit/fc480b4f305e16fe5972cf337d055e598372dc44
cvssv3.1 6.5 https://github.com/socketio/engine.io/releases/tag/6.4.2
generic_textual MODERATE https://github.com/socketio/engine.io/releases/tag/6.4.2
ssvc Track https://github.com/socketio/engine.io/releases/tag/6.4.2
cvssv3.1 6.5 https://github.com/socketio/engine.io/security/advisories/GHSA-q9mw-68c2-j6m5
cvssv3.1_qr MODERATE https://github.com/socketio/engine.io/security/advisories/GHSA-q9mw-68c2-j6m5
generic_textual MODERATE https://github.com/socketio/engine.io/security/advisories/GHSA-q9mw-68c2-j6m5
ssvc Track https://github.com/socketio/engine.io/security/advisories/GHSA-q9mw-68c2-j6m5
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2023-31125
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2023-31125
cvssv3.1 6.5 https://security.netapp.com/advisory/ntap-20230622-0002
generic_textual MODERATE https://security.netapp.com/advisory/ntap-20230622-0002
cvssv3.1 6.5 https://security.netapp.com/advisory/ntap-20230622-0002/
ssvc Track https://security.netapp.com/advisory/ntap-20230622-0002/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-31125.json
https://api.first.org/data/v1/epss?cve=CVE-2023-31125
https://github.com/socketio/engine.io
https://nvd.nist.gov/vuln/detail/CVE-2023-31125
https://security.netapp.com/advisory/ntap-20230622-0002
2203761 https://bugzilla.redhat.com/show_bug.cgi?id=2203761
6.4.2 https://github.com/socketio/engine.io/releases/tag/6.4.2
fc480b4f305e16fe5972cf337d055e598372dc44 https://github.com/socketio/engine.io/commit/fc480b4f305e16fe5972cf337d055e598372dc44
GHSA-q9mw-68c2-j6m5 https://github.com/advisories/GHSA-q9mw-68c2-j6m5
GHSA-q9mw-68c2-j6m5 https://github.com/socketio/engine.io/security/advisories/GHSA-q9mw-68c2-j6m5
ntap-20230622-0002 https://security.netapp.com/advisory/ntap-20230622-0002/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-31125.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/socketio/engine.io
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/socketio/engine.io/commit/fc480b4f305e16fe5972cf337d055e598372dc44
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-29T14:56:37Z/ Found at https://github.com/socketio/engine.io/commit/fc480b4f305e16fe5972cf337d055e598372dc44
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/socketio/engine.io/releases/tag/6.4.2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-29T14:56:37Z/ Found at https://github.com/socketio/engine.io/releases/tag/6.4.2
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/socketio/engine.io/security/advisories/GHSA-q9mw-68c2-j6m5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-29T14:56:37Z/ Found at https://github.com/socketio/engine.io/security/advisories/GHSA-q9mw-68c2-j6m5
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-31125
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20230622-0002
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20230622-0002/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-29T14:56:37Z/ Found at https://security.netapp.com/advisory/ntap-20230622-0002/
Exploit Prediction Scoring System (EPSS)
Percentile 0.78311
EPSS Score 0.01086
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:23:27.923048+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2023/31xxx/CVE-2023-31125.json 38.6.0