CVE-2026-59724
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability in Socket.IO (versions 6.5.0 through 6.6.7) allows a DoS attack by sending a crafted session ID (e.g., __proto__) during the WebTransport upgrade process. The bug causes a TypeError, leading to server crash.
Risk Assessment
An attacker can remotely crash the Socket.IO server, disrupting real-time communication for all users and potentially causing service unavailability.
Recommendation
Immediately upgrade Socket.IO to version 6.6.7 or later. If an upgrade is not possible, temporarily disable WebTransport support in the server configuration.
Other vulnerabilities in Socket.IO
See all- CVE-2026-69185High
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to versions 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.
- CVE-2026-59725High
A vulnerability in Socket.IO (versions 4.1.0 through 6.6.7) affects the Engine.IO v4 protocol polling transport. Improper closure of HTTP responses for invalid binary POST requests with Content-Type: application/octet-stream allows an unauthenticated attacker to exhaust server-side connections and sockets.
Original NVD description (English source)
Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object during WebTransport upgrade handling, causing a TypeError and denial of service. This issue is fixed in version 6.6.7.