CVE-2020-36048: 
JavaScript vulnerability analysis and mitigation

Engine.IO before version 4.0.0 contains a denial of service (DoS) vulnerability that allows attackers to cause resource consumption through a POST request to the long polling transport. The vulnerability was discovered in 2020 and assigned identifier CVE-2020-36048. By default, Engine.IO's max_http_buffer_size was set to 100MB, which could be exploited by malicious clients sending large amounts of data (Socket Blog, NVD).

The vulnerability exists in the packet parsing implementation when using the HTTP long polling transport. The server inefficiently processes packets from payloads, especially with the maximum HTTP body size set to 100MB. An attacker can exploit this by sending either many tiny packets (causing O(n^2) processing complexity), one giant integer packet, or many heartbeat packets. In NodeJS implementations, this can lead to memory exhaustion and process termination with 'JavaScript heap out of memory' errors (Socket Blog, Kill Engine).

When successfully exploited, this vulnerability can cause extreme CPU and memory usage on the target server. In NodeJS implementations, a single HTTP POST request can cause the server process to terminate with a fatal error due to memory exhaustion. The attack can effectively render the service unavailable, making this a significant denial of service vulnerability (Socket Blog).

The vulnerability is easily exploitable through a single HTTP POST request to the long polling transport endpoint. Proof-of-concept code has been published demonstrating multiple attack vectors including sending many tiny packets, one giant integer packet, or many heartbeat packets. The attack can be executed with minimal resources and technical knowledge (Kill Engine).

The vulnerability was fixed in Engine.IO version 4.0.0 by reducing the default maxHttpBufferSize from 100MB to 1MB, helping protect servers against denial of service attacks from malicious clients. For earlier versions, recommended mitigations include setting max_http_buffer_size to a sensible value, using SockJS instead of SocketIO, improving library performance, and restricting the number of packets per payload (Engine Commit).