Socket.IO vulnerabilities
3 known CVE vulnerabilities in Socket.IO, translated and rated.
- CVE-2026-69185High
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to versions 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.
- CVE-2026-59725High
A vulnerability in Socket.IO (versions 4.1.0 through 6.6.7) affects the Engine.IO v4 protocol polling transport. Improper closure of HTTP responses for invalid binary POST requests with Content-Type: application/octet-stream allows an unauthenticated attacker to exhaust server-side connections and sockets.
- CVE-2026-59724High
A vulnerability in Socket.IO (versions 6.5.0 through 6.6.7) allows a DoS attack by sending a crafted session ID (e.g., __proto__) during the WebTransport upgrade process. The bug causes a TypeError, leading to server crash.