{"id":"CVE-2026-33151","aliases":["CLSA-2026-1776731787","CLSA-2026-1779324474","CLSA-2026-1779324475","CLSA-2026-1779324477","CLSA-2026-1784077498","CLSA-2026-1784769501","CLSA-2026-1791899634","CLSA-2026-1792599106","CLSA-2026-1792665531","CLSA-2026-1792666457","DEBIAN-CVE-2026-33151","EUVD-2026-13788","GHSA-677m-j7p3-52f9","ROOT-APP-NPM-CVE-2026-33151","UBUNTU-CVE-2026-33151"],"status":"published","title":"socket.io allows an unbounded number of binary attachments","description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00535,"percentile":0.45375,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-754"],"published":"2026-03-18T17:26:14Z","modified":"2026-10-28T02:31:01Z","fixes":[{"ecosystem":"npm","package":"socket.io-parser","fixed_in":["3.3.5","3.4.4","4.2.6"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"socket.io-parser","fixed_in":["3.4.3-tuxcare.1","4.2.4-tuxcare.1","3.3.4-tuxcare.1","3.2.0-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-socket.io-parser","fixed_in":["4.2.1+~3.1.0-4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"socket.io-parser","fixed_in":["4.2.4-aikido.1","4.2.4-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/socket.io-parser","fixed_in":["4.2.4-root.io.1","4.2.4-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.2.6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.3-tuxcare.0"},{"fixed":"3.1.3-tuxcare.1"}]}],"versions":["3.1.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.3-tuxcare.0"},{"fixed":"3.4.3-tuxcare.1"}]}],"versions":["3.4.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.4-tuxcare.0"},{"fixed":"4.2.4-tuxcare.1"}]}],"versions":["4.2.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.4-tuxcare.0"},{"fixed":"3.3.4-tuxcare.1"}]}],"versions":["3.3.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.2"}]}],"versions":["3.2.0","3.2.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.1-tuxcare.0"},{"fixed":"2.3.1-tuxcare.1"}]}],"versions":["2.3.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.2-tuxcare.0"},{"fixed":"2.2.2-tuxcare.1"}]}],"versions":["2.2.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.4-tuxcare.0"},{"fixed":"2.2.4-tuxcare.1"}]}],"versions":["2.2.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.5-tuxcare.0"},{"fixed":"4.0.5-tuxcare.1"}]}],"versions":["4.0.5"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1+~3.1.0-2","4.2.1+~3.1.0-3","4.2.1+~3.1.0-4","4.2.4+~3.1.2-1","4.2.4+~3.1.2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1+~3.1.0-3","4.2.1+~3.1.0-4","4.2.4+~3.1.2-1","4.2.4+~3.1.2-2"]},{"source":"osv","ecosystem":"Debian:14","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1+~3.1.0-4"}]}],"versions":["4.2.1+~3.1.0-3"]},{"source":"osv","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.5"}]}]},{"source":"osv","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"3.4.0"},{"fixed":"3.4.4"}]}]},{"source":"osv","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.2.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-aikido.1"},{"fixed":"4.2.4-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-root.io.1"},{"fixed":"4.2.4-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.0-1","3.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.2-1","4.1.1+~3.0.0-1","4.1.2+~3.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1+~3.1.0-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1+~3.1.0-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1+~3.1.0-3","4.2.1+~3.1.0-4"]}],"products":[{"vendor":"socket","product":"socket.io-parser"},{"vendor":"socketio","product":"socket.io"}],"references":[{"url":"https://github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/socketio/socket.io/commit/719f9ebab0772ffb882bd614b387e585c1aa75d4","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/socketio/socket.io/commit/9d39f1f080510f036782f2177fac701cc041faaf","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/socketio/socket.io/commit/b25738c416c4e32fbff62ee182afa8f6d0dacf78","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33151","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-677m-j7p3-52f9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33151.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-33151","tags":["advisory"]},{"url":"https://github.com/socketio/socket.io","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-33151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33151","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-33151","title":"socket.io allows an unbounded number of binary attachments","description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.","status":"published","published":"2026-03-20T20:13:31.424Z","modified":"2026-03-23T16:50:16.998Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-20","CWE-754"],"updated_at":"2026-11-02T14:20:08.009733Z"}],"euvd":[{"id":"EUVD-2026-13788","description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.","status":"published","published":"2026-03-20T20:13:31Z","modified":"2026-03-23T16:50:16Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:25:30.696372Z"}],"ghsa":[{"id":"GHSA-677m-j7p3-52f9","title":"socket.io allows an unbounded number of binary attachments","description":"### Impact\n\nA specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.\n\n### Patches\n\n| Version range    | Used by                                    | Fixed version |\n|------------------|--------------------------------------------|---------------|\n| `\u003e=4.0.0 \u003c4.2.6` | `socket.io@4.x` and `socket.io-client@4.x` | `4.2.6`       |\n| `\u003e=3.4.0 \u003c3.4.4` | `socket.io@2.x`                            | `3.4.4`       |\n| `\u003c3.3.5`         | `socket.io-client@2.x`                     | `3.3.5`       |\n\n### Workarounds\n\nThere is no known workaround except upgrading to a safe version.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open a discussion [here](https://github.com/socketio/socket.io/discussions)","status":"published","published":"2026-03-18T17:26:14Z","modified":"2026-03-20T21:33:54Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:39:40.633038Z"}],"nvd":[{"id":"CVE-2026-33151","description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.","status":"published","published":"2026-03-20T21:17:15.573Z","modified":"2026-06-17T10:37:02.107Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20","CWE-754"],"updated_at":"2026-11-02T14:12:10.126802Z"}],"osv":[{"id":"CVE-2026-33151","title":"socket.io allows an unbounded number of binary attachments","description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.","status":"published","published":"2026-03-20T20:13:31.424Z","modified":"2026-11-07T02:48:39.207412822Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-20","CWE-754"],"updated_at":"2026-11-07T03:08:04.04988Z"},{"id":"DEBIAN-CVE-2026-33151","description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.","status":"published","published":"2026-03-20T21:17:15.573Z","modified":"2026-10-01T03:03:03.921968296Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"GHSA-677m-j7p3-52f9","title":"socket.io allows an unbounded number of binary attachments","description":"### Impact\n\nA specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.\n\n### Patches\n\n| Version range    | Used by                                    | Fixed version |\n|------------------|--------------------------------------------|---------------|\n| `\u003e=4.0.0 \u003c4.2.6` | `socket.io@4.x` and `socket.io-client@4.x` | `4.2.6`       |\n| `\u003e=3.4.0 \u003c3.4.4` | `socket.io@2.x`                            | `3.4.4`       |\n| `\u003c3.3.5`         | `socket.io-client@2.x`                     | `3.3.5`       |\n\n### Workarounds\n\nThere is no known workaround except upgrading to a safe version.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open a discussion [here](https://github.com/socketio/socket.io/discussions)","status":"published","published":"2026-03-18T17:26:14Z","modified":"2026-09-10T03:50:37.788695682Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"UBUNTU-CVE-2026-33151","description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.","status":"published","published":"2026-03-20T21:17:00Z","modified":"2026-05-20T16:25:24.106987621Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"CLSA-2026-1776731787","title":"TuxCare security update for socket.io-parser (3 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 3 CVEs. Fixed in 3.1.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-25T01:43:09.398850678Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1779324474","title":"TuxCare security update for socket.io-parser (1 CVE)","description":"TuxCare rebuilt socket.io-parser to address 1 CVE. Fixed in 3.4.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:48:03.548038857Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779324475","title":"TuxCare security update for socket.io-parser (1 CVE)","description":"TuxCare rebuilt socket.io-parser to address 1 CVE. Fixed in 4.2.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:47:50.181130361Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779324477","title":"TuxCare security update for socket.io-parser (1 CVE)","description":"TuxCare rebuilt socket.io-parser to address 1 CVE. Fixed in 3.3.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:48:03.298142495Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1784077498","title":"TuxCare security update for 7 packages (3 CVEs)","description":"TuxCare rebuilt 7 packages to address 3 CVEs. Fixed in 3.2.0-tuxcare.2.","status":"withdrawn","published":"2026-08-04T14:52:44Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784769501","title":"TuxCare security update for socket.io-parser (1 CVE)","description":"TuxCare rebuilt socket.io-parser to address 1 CVE. Fixed in 3.2.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:54.376362442Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1791899634","title":"TuxCare security update for socket.io-parser (5 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 5 CVEs. Fixed in 2.3.1-tuxcare.1.","status":"published","published":"2026-10-13T13:53:54Z","modified":"2026-10-15T09:47:53.469310802Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792599106","title":"TuxCare security update for socket.io-parser (5 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 5 CVEs. Fixed in 2.2.2-tuxcare.1.","status":"published","published":"2026-10-21T16:11:46Z","modified":"2026-10-21T20:30:50.501354765Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792665531","title":"TuxCare security update for socket.io-parser (5 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 5 CVEs. Fixed in 2.2.4-tuxcare.1.","status":"published","published":"2026-10-22T10:38:51Z","modified":"2026-10-22T14:15:04.657404145Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792666457","title":"TuxCare security update for socket.io-parser (2 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 2 CVEs. Fixed in 4.0.5-tuxcare.1.","status":"published","published":"2026-10-22T10:54:17Z","modified":"2026-10-22T14:15:04.616703857Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"ROOT-APP-NPM-CVE-2026-33151","title":"CVE-2026-33151 in socket.io-parser - Patched by Root","description":"Root has patched CVE-2026-33151 in the socket.io-parser package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-18T19:57:01Z","modified":"2026-08-18T21:45:03.669378848Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}