Read the docs
TI-2016-08578 Aliases CVE-2016-10536GHSA-4r4m-hjwj-43p8

Improper certificate validation in HackerOne engine.io-client node module

Priority LOW 28CWE-300Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-295.

Summary

engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the `rejectUnauthorized` setting. If the value is something that evaluates to false, certificate verification will be disabled. This is problematic as engine.io-client 1.6.8 and earlier passes in an object for settings that includes the rejectUnauthorized property, whether it has been set or not. If the value has not been explicitly changed, it will be passed in as `null`, resulting in certificate verification being turned off.

Why it matters now

EPSS 0.00997 62nd percentileScored 2026-11-07
Fix Fixed engine.io-client (npm): 1.6.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HackerOneengine.io-client node moduleup to 1.6.8—No fix listedCNA
—engine.io-client (npm)before 1.6.91.6.9Patch availableGHSA-4r4m-hjwj-43p8
  • engine.io-client node module VendorHackerOne Affected up to 1.6.8 Fixed in — No fix listed CNA
  • engine.io-client (npm) Vendor— Affected before 1.6.9 Fixed in 1.6.9 Patch available GHSA-4r4m-hjwj-43p8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:socket:engine.io-client:*:*:*:*:*:node.js:*:*up to 1.6.8Vulnerablesocketio
  • cpe:2.3:a:socket:engine.io-client:*:*:*:*:*:node.js:*:* Versions up to 1.6.8 Vulnerable ·socketio

Remediation

  • Fix · GHSA-4r4m-hjwj-43p8 engine.io-client (npm) Fixed in 1.6.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-10536
  2. 2026-10-03 Alias added: GHSA-4r4m-hjwj-43p8

References

Patch 1

Advisory 4

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences