CVE-2026-59725 Details

A denial-of-service vulnerability has been identified in Socket.IO's Engine.IO component, specifically in versions 4.1.0 prior to 6.6.7. The issue arises in the Engine.IO protocol v4 polling transport, where the server fails to properly close HTTP responses for invalid binary POST requests with a Content-Type of application/octet-stream. This oversight allows an unauthenticated attacker to open multiple polling sessions, each consuming a server-side socket or resource. The result is exhaustion of available HTTP connections, sockets, file descriptors, or related server resources, potentially disrupting service for legitimate clients.

Users should upgrade to Engine.IO version 6.6.7 or later, or to a Socket.IO release that depends on a fixed Engine.IO version. If an immediate upgrade is not possible, consider blocking or rejecting polling POST requests with application/octet-stream content type at a reverse proxy, load balancer, WAF, or application middleware. Alternatively, disable HTTP long-polling if WebSocket-only transport is an option, enforce strict request and connection timeouts, apply per-IP rate limits and connection limits for Engine.IO endpoints, or restrict access to the Socket.IO/Engine.IO endpoint where feasible.