[GHSA-r635-g3xr-vw7x] Socket.IO: Engine.IO Polling Transport Connection Exhaustion

[abdelkabirouadoukou]

Updates

• Description
• References

Comments
We propose these additions, supported by the upstream fix commit:

1. State explicitly that both HTTP stacks are affected (Node HTTP polling transport and the transports-uws µWebSockets polling transport), since the fix patches both packages/engine.io/lib/transports/polling.ts (closed via res.writeHead(400).end()) and packages/engine.io/lib/transports-uws/polling.ts (via res.writeStatus("400 Bad Request").end()).
2. Add the introducing commit to References: the fix commit fc11285 states the behavior "was introduced in engine.io@4.1.0 (January 2021)" and references commit 663d326, which supports the affected lower bound of >= 4.1.0.
   Both changes improve the precision and reproducibility of the affected-version range and clarify the affected HTTP server implementations.

[github]

Hi there @darrachequesne! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.