Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

js-jquery 3.5.0-4 can be flooded to halt service

published 5 years ago
Summary

The Engine.IO component used in js-jquery versions before 4.0.0 can be overloaded by a crafted POST request, consuming resources and potentially stopping the service from responding. This can make your web application slow or unavailable for users. Update the library to version 4.0.0 or later and consider adding request‑rate limits or monitoring to protect against excessive traffic.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure js-jquery <= 3.5.0-4
Original advisory text
CVE-2020-36048 affecting package js-jquery 3.5.0-4
Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Timeline
Published8 Jan 2021
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-44673 · OSV
Track software like this
Free during beta