Affected versions of engine.io-client do not verify certificates by default, and as such may be vulnerable to Man-in-the-Middle attacks.

The vulnerability is related to the way that node.js handles the rejectUnauthorized setting. If the value is something that evaluates to false, such as undefined or null, certificate verification will be disabled.

Recommendation

Update to version 1.6.9 or later.

If you are unable to upgrade, ensure all calls to socket.io to have a rejectedUnauthorized: true flag.

References

• https://nvd.nist.gov/vuln/detail/CVE-2016-10536
• socketio/engine.io-client@2c55b27
• GHSA-4r4m-hjwj-43p8
• https://www.cigital.com/blog/node-js-socket-io/
• https://www.npmjs.com/advisories/99