CVE-2026-33151
socket.io allows an unbounded number of binary attachments
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
socket.io allows an unbounded number of binary attachments
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.
- Record
CVE-2026-33151- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-20, CWE-754
- Updated
- 2026-11-02
EUVDEUVD-2026-13788
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.
- Record
EUVD-2026-13788- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-677m-j7p3-52f9
socket.io allows an unbounded number of binary attachments
Impact
A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.
Patches
| Version range | Used by | Fixed version |
|------------------|--------------------------------------------|---------------|
| >=4.0.0 <4.2.6 | [email protected] and [email protected] | 4.2.6 |
| >=3.4.0 <3.4.4 | [email protected] | 3.4.4 |
| <3.3.5 | [email protected] | 3.3.5 |
Workarounds
There is no known workaround except upgrading to a safe version.
For more information
If you have any questions or comments about this advisory:
- Open a discussion here
- Record
GHSA-677m-j7p3-52f9- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-754
- Updated
- 2026-11-02
NVD
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.
- Record
CVE-2026-33151- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-754
- Updated
- 2026-11-02
OSV
socket.io allows an unbounded number of binary attachments
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.
- Record
CVE-2026-33151- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-20, CWE-754
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2026-33151
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.
- Record
DEBIAN-CVE-2026-33151- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 13 moreShow less
OSVGHSA-677m-j7p3-52f9
socket.io allows an unbounded number of binary attachments
Impact
A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.
Patches
| Version range | Used by | Fixed version |
|------------------|--------------------------------------------|---------------|
| >=4.0.0 <4.2.6 | [email protected] and [email protected] | 4.2.6 |
| >=3.4.0 <3.4.4 | [email protected] | 3.4.4 |
| <3.3.5 | [email protected] | 3.3.5 |
Workarounds
There is no known workaround except upgrading to a safe version.
For more information
If you have any questions or comments about this advisory:
- Open a discussion here
- Record
GHSA-677m-j7p3-52f9- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-754
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-33151
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.
- Record
UBUNTU-CVE-2026-33151- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1776731787 No score
TuxCare security update for socket.io-parser (3 CVEs)
TuxCare rebuilt socket.io-parser to address 3 CVEs. Fixed in 3.1.3-tuxcare.1.
- Record
CLSA-2026-1776731787- Updated
- 2026-11-02
OSVCLSA-2026-1779324474 No score
TuxCare security update for socket.io-parser (1 CVE)
TuxCare rebuilt socket.io-parser to address 1 CVE. Fixed in 3.4.3-tuxcare.1.
- Record
CLSA-2026-1779324474- Updated
- 2026-11-02
OSVCLSA-2026-1779324475 No score
TuxCare security update for socket.io-parser (1 CVE)
TuxCare rebuilt socket.io-parser to address 1 CVE. Fixed in 4.2.4-tuxcare.1.
- Record
CLSA-2026-1779324475- Updated
- 2026-11-02
OSVCLSA-2026-1779324477 No score
TuxCare security update for socket.io-parser (1 CVE)
TuxCare rebuilt socket.io-parser to address 1 CVE. Fixed in 3.3.4-tuxcare.1.
- Record
CLSA-2026-1779324477- Updated
- 2026-11-02
OSVCLSA-2026-1784077498 No score
TuxCare security update for 7 packages (3 CVEs)
TuxCare rebuilt 7 packages to address 3 CVEs. Fixed in 3.2.0-tuxcare.2.
- Record
CLSA-2026-1784077498- Updated
- 2026-11-02
OSVCLSA-2026-1784769501 No score
TuxCare security update for socket.io-parser (1 CVE)
TuxCare rebuilt socket.io-parser to address 1 CVE. Fixed in 3.2.0-tuxcare.2.
- Record
CLSA-2026-1784769501- Updated
- 2026-11-02
OSVCLSA-2026-1791899634 No score
TuxCare security update for socket.io-parser (5 CVEs)
TuxCare rebuilt socket.io-parser to address 5 CVEs. Fixed in 2.3.1-tuxcare.1.
- Record
CLSA-2026-1791899634- Updated
- 2026-11-02
OSVCLSA-2026-1792599106 No score
TuxCare security update for socket.io-parser (5 CVEs)
TuxCare rebuilt socket.io-parser to address 5 CVEs. Fixed in 2.2.2-tuxcare.1.
- Record
CLSA-2026-1792599106- Updated
- 2026-11-02
OSVCLSA-2026-1792665531 No score
TuxCare security update for socket.io-parser (5 CVEs)
TuxCare rebuilt socket.io-parser to address 5 CVEs. Fixed in 2.2.4-tuxcare.1.
- Record
CLSA-2026-1792665531- Updated
- 2026-11-02
OSVCLSA-2026-1792666457 No score
TuxCare security update for socket.io-parser (2 CVEs)
TuxCare rebuilt socket.io-parser to address 2 CVEs. Fixed in 4.0.5-tuxcare.1.
- Record
CLSA-2026-1792666457- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-33151 No score
CVE-2026-33151 in socket.io-parser - Patched by Root
Root has patched CVE-2026-33151 in the socket.io-parser package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-33151- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
socket.io-parsernpm |
before 3.3.5 | 3.3.5 |
socket.io-parsernpm |
3.4.0 up to 3.4.4 | 3.4.4 |
socket.io-parsernpm |
4.0.0 up to 4.2.6 | 4.2.6 |
socket.io-parserTuxCare:npm From an advisory covering 3 CVEs |
3.1.3-tuxcare.0 up to 3.1.3-tuxcare.1, plus listed versions 3.1.3 |
3.1.3-tuxcare.1 |
socket.io-parserTuxCare:npm |
3.4.3-tuxcare.0 up to 3.4.3-tuxcare.1, plus listed versions 3.4.3 |
3.4.3-tuxcare.1 |
socket.io-parserTuxCare:npm |
4.2.4-tuxcare.0 up to 4.2.4-tuxcare.1, plus listed versions 4.2.4 |
4.2.4-tuxcare.1 |
socket.io-parserTuxCare:npm |
3.3.4-tuxcare.0 up to 3.3.4-tuxcare.1, plus listed versions 3.3.4 |
3.3.4-tuxcare.1 |
socket.io-parserTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.2, plus listed versions 3.2.03.2.0-tuxcare.1 |
3.2.0-tuxcare.2 |
socket.io-parserTuxCare:npm From an advisory covering 5 CVEs |
2.3.1-tuxcare.0 up to 2.3.1-tuxcare.1, plus listed versions 2.3.1 |
2.3.1-tuxcare.1 |
socket.io-parserTuxCare:npm From an advisory covering 5 CVEs |
2.2.2-tuxcare.0 up to 2.2.2-tuxcare.1, plus listed versions 2.2.2 |
2.2.2-tuxcare.1 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
socket.io-parserTuxCare:npm From an advisory covering 5 CVEs |
2.2.4-tuxcare.0 up to 2.2.4-tuxcare.1, plus listed versions 2.2.4 |
2.2.4-tuxcare.1 |
socket.io-parserTuxCare:npm From an advisory covering 2 CVEs |
4.0.5-tuxcare.0 up to 4.0.5-tuxcare.1, plus listed versions 4.0.5 |
4.0.5-tuxcare.1 |
node-socket.io-parserDebian:12 |
All versions, plus listed versions 4.2.1+~3.1.0-24.2.1+~3.1.0-34.2.1+~3.1.0-44.2.4+~3.1.2-14.2.4+~3.1.2-2 |
None known |
node-socket.io-parserDebian:13 |
All versions, plus listed versions 4.2.1+~3.1.0-34.2.1+~3.1.0-44.2.4+~3.1.2-14.2.4+~3.1.2-2 |
None known |
node-socket.io-parserDebian:14 |
before 4.2.1+~3.1.0-4, plus listed versions 4.2.1+~3.1.0-3 |
4.2.1+~3.1.0-4 |
socket.io-parserRoot:npm |
before 4.2.4-aikido.1 | 4.2.4-aikido.14.2.4-aikido.2 |
@rootio/socket.io-parserRoot:npm |
before 4.2.4-root.io.1 | 4.2.4-root.io.14.2.4-root.io.2 |
node-socket.io-parserUbuntu:18.04:LTS |
All versions, plus listed versions 2.3.1-1 |
None known |
node-socket.io-parserUbuntu:20.04:LTS |
All versions, plus listed versions 3.3.0-13.4.0-1 |
None known |
node-socket.io-parserUbuntu:22.04:LTS |
All versions, plus listed versions 4.0.2-14.1.1+~3.0.0-14.1.2+~3.0.0-1 |
None known |
node-socket.io-parserUbuntu:24.04:LTS |
All versions, plus listed versions 4.2.1+~3.1.0-3 |
None known |
node-socket.io-parserUbuntu:25.10 |
All versions, plus listed versions 4.2.1+~3.1.0-3 |
None known |
node-socket.io-parserUbuntu:26.04:LTS |
All versions, plus listed versions 4.2.1+~3.1.0-34.2.1+~3.1.0-4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-33151 is a high vulnerability (CVSS 8.7) in Socketio Socket.io, published March 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in socket.io-parser 3.3.5.
References
github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9
nvd.nist.gov/vuln/detail/CVE-2026-33151