Vulnerability details
CVE-2026-69185
socketio socket.io
Socket.IO: Zero-attachment Memory Exhaustion
CVSS 3.1
7.5High
Official description
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| socketio | socket.io | < 3.3.6 | CVEProject cvelistV5 (CNA) |
| socketio | socket.io | >= 3.4.0, < 3.4.5 | CVEProject cvelistV5 (CNA) |
| socketio | socket.io | >= 4.0.0, < 4.2.7 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr x_refsource_CONFIRM
- https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4 x_refsource_MISC
- https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240 x_refsource_MISC
- https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-03
- Last updated
- 2026-08-04
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.63%
Probability of exploitation in 30 days
50.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-20Improper Input Validation
- CWE-754Improper Check for Unusual or Exceptional Conditions