socket.io/packages/engine.io-client/SECURITY.md

Security Policy

Supported Versions

Version	socket.io-client version	Supported
6.x	4.x	✅
4.x	3.x	✅
3.5.x	2.4.x	✅
< 3.5.0	< 2.4.0	❌

Reporting a Vulnerability

To report a security vulnerability in this package, please send an email to @darrachequesne (see address in profile) describing the vulnerability and how to reproduce it.

We will get back to you as soon as possible and publish a fix if necessary.

⚠️ IMPORTANT ⚠️ please do not create an issue in this repository, as attackers might take advantage of it. Thank you in advance for your responsible disclosure.

History

• Mar 2016: Insecure Defaults Allow MITM Over TLS in engine.io-client (CVE-2016-10536)