Skip to content
OpenAdvisories

Vendor

@socket.io

2 known vulnerabilities.

Products

Socket.io-Parser 1 cluster-engine 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-102600

    Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

    Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such …

    socketio @socket.io socket.io cluster-engine npm