CVE-2026-69185 Details
Description
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.
A denial-of-service vulnerability has been identified in Socket.IO versions prior to 4.2.7, 3.4.5, and 3.3.6. The issue arises when a Socket.IO packet is received with a binary attachment count of zero. Such packets are invalid, as they should be encoded as regular EVENT or ACK packets. However, the server can be made to wait for a large number of binary attachments, leading to excessive memory consumption and exhaustion. This vulnerability has been addressed by rejecting binary packets with zero attachments, a change that has been backported to the 3.4.x and 3.3.x branches.
Upgrade to Socket.IO versions 4.2.7, 3.4.5, or 3.3.6.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |