### Impact

A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.

> RangeError: Invalid WebSocket frame: RSV2 and RSV3 must be clear
> at Receiver.getInfo (/…/node_modules/ws/lib/receiver.js:176:14)
> at Receiver.startLoop (/…/node_modules/ws/lib/receiver.js:136:22)
> at Receiver._write (/…/node_modules/ws/lib/receiver.js:83:10)
> at writeOrBuffer (internal/streams/writable.js:358:12)

This impacts all the users of the [`engine.io`](https://www.npmjs.com/package/engine.io) package starting from version `4.0.0`, including those who uses depending packages like [`socket.io`](https://www.npmjs.com/package/socket.io).

### Patches

A fix has been released for each major branch:

| Version range | Fixed version |
| — | — |
| `[email protected]` | `4.1.2` |
| `[email protected]` | `5.2.1` |
| `[email protected]` | `6.1.1` |

Previous versions (`Read More