Skip to content
OpenAdvisories

Vendor

socketio

11 known vulnerabilities.

Products

socket.io 6 engine.io 4 socket.io-parser 1
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 7.5
    CVE-2026-102599

    Socket.IO: Engine.IO Protocol Revision Mismatch DoS

    Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored …

    socketio socket.io engine.io npm
  • High 7.5
    CVE-2026-102600

    Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

    Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such …

    socketio @socket.io socket.io cluster-engine npm
  • High 7.5
    CVE-2026-69185

    Socket.IO: Zero-attachment Memory Exhaustion

    Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited …

    socketio socket.io socket.io-parser node-socket.io-parser Debian Ubuntu npm
  • High 7.5
    CVE-2026-59725

    Socket.IO: Engine.IO Polling Transport Connection Exhaustion

    Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-…

    socketio engine.io engine.io npm
  • High 7.5
    CVE-2026-59724

    Socket.IO: Engine.IO WebTransport SID DoS

    Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object durin…

    socketio socket.io engine.io npm
  • High 8.7
    CVE-2026-33151

    socket.io allows an unbounded number of binary attachments

    Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, whi…

    socketio socket.io socket.io-parser node-socket.io-parser Debian Ubuntu npm
  • High 7.3
    CVE-2024-38355 Public exploit

    Unhandled 'error' event in socket.io

    Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af2…

    socketio socket.io socket.io npm
  • High 7.3
    CVE-2023-32695

    Insufficient validation when decoding a Socket.IO packet

    socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch…

    socketio socket.io-parser socket.io-parser node-socket.io-parser Debian Ubuntu npm
  • High 7.1
    CVE-2022-41940

    Uncaught exception in engine.io

    Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This …

    socketio engine.io engine.io npm
  • High 7.5
    CVE-2022-21676

    Uncaught Exception in engine.io

    Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This …

    socketio engine.io engine.io npm