CVE-2026-69185
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.
- CVSS 3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-20, CWE-754
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2m8v-j782-fhvr | npm | socket.io-parser | >=4.0.0 <4.2.7 | 4.2.7 |
| GHSA-2m8v-j782-fhvr | npm | socket.io-parser | >=3.4.0 <3.4.5 | 3.4.5 |
| GHSA-2m8v-j782-fhvr | npm | socket.io-parser | <3.3.6 | 3.3.6 |
References
- https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4
- https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240
- https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291
- https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr