What’s Vulnerable › Vulnerabilities

CVE-2026-69185: Socket.IO: Zero-attachment Memory Exhaustion

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-03 · updated 2026-10-23
• Weakness: CWE-20

Description

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.

Affected products

• socketio socket.io: before 3.3.6; from 3.4.0, < 3.4.5; from 4.0.0, < 4.2.7

References

• https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4
• https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240
• https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291
• https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr

Get alerted when CVE-2026-69185 or the next vulnerability affects your stack