CVE-2026-59725
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A vulnerability in Socket.IO (versions 4.1.0 through 6.6.7) affects the Engine.IO v4 protocol polling transport. Improper closure of HTTP responses for invalid binary POST requests with Content-Type: application/octet-stream allows an unauthenticated attacker to exhaust server-side connections and sockets.
Risk Assessment
An attacker can perform a resource exhaustion attack, leading to denial of service (DoS) for legitimate users of applications using Socket.IO.
Recommendation
Immediately update the Socket.IO library to version 6.6.7 or later, which contains the fix for this vulnerability.
Other vulnerabilities in Socket.IO
See all- CVE-2026-69185High
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to versions 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.
- CVE-2026-59724High
A vulnerability in Socket.IO (versions 6.5.0 through 6.6.7) allows a DoS attack by sending a crafted session ID (e.g., __proto__) during the WebTransport upgrade process. The bug causes a TypeError, leading to server crash.
Original NVD description (English source)
Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.