Skip to content
OpenAdvisories

Product · socketio

socket.io

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.5
    CVE-2026-102599

    Socket.IO: Engine.IO Protocol Revision Mismatch DoS

    Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored …

    socketio socket.io engine.io npm
  • High 7.5
    CVE-2026-102600

    Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

    Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such …

    socketio @socket.io socket.io cluster-engine npm
  • High 7.5
    CVE-2026-69185

    Socket.IO: Zero-attachment Memory Exhaustion

    Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited …

    socketio socket.io socket.io-parser node-socket.io-parser Debian Ubuntu npm
  • High 7.5
    CVE-2026-59724

    Socket.IO: Engine.IO WebTransport SID DoS

    Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object durin…

    socketio socket.io engine.io npm
  • High 8.7
    CVE-2026-33151

    socket.io allows an unbounded number of binary attachments

    Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, whi…

    socketio socket.io socket.io-parser node-socket.io-parser Debian Ubuntu npm
  • High 7.3
    CVE-2024-38355 Public exploit

    Unhandled 'error' event in socket.io

    Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af2…

    socketio socket.io socket.io npm