{"id":"CVE-2026-69185","aliases":["CLSA-2026-1788863154","CLSA-2026-1788863169","CLSA-2026-1788863171","CLSA-2026-1791899634","CLSA-2026-1792599106","CLSA-2026-1792665531","CLSA-2026-1792666457","DEBIAN-CVE-2026-69185","EUVD-2026-52410","GHSA-2m8v-j782-fhvr","UBUNTU-CVE-2026-69185"],"status":"published","title":"Socket.IO: Zero-attachment Memory Exhaustion","description":"Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0063,"percentile":0.50468,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-754"],"published":"2026-08-03T19:09:10Z","modified":"2026-10-28T02:30:23Z","fixes":[{"ecosystem":"npm","package":"socket.io-parser","fixed_in":["4.2.7","3.4.5","3.3.6"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"socket.io-parser","fixed_in":["3.2.0-tuxcare.3","3.1.3-tuxcare.2","3.3.4-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-socket.io-parser","fixed_in":["4.2.4+~3.1.2-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.2.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.3"}]}],"versions":["3.2.0","3.2.0-tuxcare.1","3.2.0-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.3-tuxcare.0"},{"fixed":"3.1.3-tuxcare.2"}]}],"versions":["3.1.3","3.1.3-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.4-tuxcare.0"},{"fixed":"3.3.4-tuxcare.2"}]}],"versions":["3.3.4","3.3.4-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.1-tuxcare.0"},{"fixed":"2.3.1-tuxcare.1"}]}],"versions":["2.3.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.2-tuxcare.0"},{"fixed":"2.2.2-tuxcare.1"}]}],"versions":["2.2.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.4-tuxcare.0"},{"fixed":"2.2.4-tuxcare.1"}]}],"versions":["2.2.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.5-tuxcare.0"},{"fixed":"4.0.5-tuxcare.1"}]}],"versions":["4.0.5"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1+~3.1.0-2","4.2.1+~3.1.0-3","4.2.1+~3.1.0-4","4.2.4+~3.1.2-1","4.2.4+~3.1.2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1+~3.1.0-3","4.2.1+~3.1.0-4","4.2.4+~3.1.2-1","4.2.4+~3.1.2-2"]},{"source":"osv","ecosystem":"Debian:14","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4+~3.1.2-1"}]}],"versions":["4.2.1+~3.1.0-3","4.2.1+~3.1.0-4"]},{"source":"osv","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.2.7"}]}]},{"source":"osv","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"3.4.0"},{"fixed":"3.4.5"}]}]},{"source":"osv","ecosystem":"npm","package":"socket.io-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.6"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.0-1","3.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.2-1","4.1.1+~3.0.0-1","4.1.2+~3.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1+~3.1.0-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1+~3.1.0-4","4.2.4+~3.1.2-1","4.2.4+~3.1.2-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-socket.io-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1+~3.1.0-3","4.2.1+~3.1.0-4"]}],"products":[{"vendor":"socketio","product":"socket.io"}],"references":[{"url":"https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/advisories/GHSA-2m8v-j782-fhvr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69185.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69185","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-69185","tags":["advisory"]},{"url":"https://github.com/socketio/socket.io","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-69185","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69185","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-69185","title":"Socket.IO: Zero-attachment Memory Exhaustion","description":"Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.","status":"published","published":"2026-08-03T19:09:10.073Z","modified":"2026-08-03T20:31:54.428Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20","CWE-754"],"updated_at":"2026-11-02T13:50:16.178634Z"}],"euvd":[{"id":"EUVD-2026-52410","description":"Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.","status":"published","published":"2026-08-03T19:09:10Z","modified":"2026-08-03T20:31:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:23.68186Z"}],"ghsa":[{"id":"GHSA-2m8v-j782-fhvr","title":"Socket.IO: Zero-attachment Memory Exhaustion","description":"### Impact\n\nA specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.\n\n### Patches\n\n| Version range    | Used by                                    | Fixed version |\n|------------------|--------------------------------------------|---------------|\n| `\u003e=4.0.0 \u003c4.2.7` | `socket.io@4.x` and `socket.io-client@4.x` | `4.2.7`       |\n| `\u003e=3.4.0 \u003c3.4.5` | `socket.io@2.x`                            | `3.4.5`       |\n| `\u003c3.3.6`         | `socket.io-client@2.x`                     | `3.3.6`       |\n\n### Workarounds\n\nThere is no known workaround except upgrading to a safe version.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open a discussion [here](https://github.com/socketio/socket.io/discussions)","status":"published","published":"2026-08-03T19:09:44Z","modified":"2026-08-03T19:09:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-754"],"updated_at":"2026-11-02T14:40:55.903445Z"}],"nvd":[{"id":"CVE-2026-69185","description":"Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.","status":"published","published":"2026-08-03T20:17:29.797Z","modified":"2026-10-23T21:10:00.157Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-20","CWE-754"],"updated_at":"2026-11-02T14:12:34.643497Z"}],"osv":[{"id":"CVE-2026-69185","title":"Socket.IO: Zero-attachment Memory Exhaustion","description":"Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.","status":"published","published":"2026-08-03T19:09:10.073Z","modified":"2026-10-28T02:30:23.354312079Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-754"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"DEBIAN-CVE-2026-69185","description":"Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.","status":"published","published":"2026-08-03T20:17:29.797Z","modified":"2026-10-24T09:47:28.842719804Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"GHSA-2m8v-j782-fhvr","title":"Socket.IO: Zero-attachment Memory Exhaustion","description":"### Impact\n\nA specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.\n\n### Patches\n\n| Version range    | Used by                                    | Fixed version |\n|------------------|--------------------------------------------|---------------|\n| `\u003e=4.0.0 \u003c4.2.7` | `socket.io@4.x` and `socket.io-client@4.x` | `4.2.7`       |\n| `\u003e=3.4.0 \u003c3.4.5` | `socket.io@2.x`                            | `3.4.5`       |\n| `\u003c3.3.6`         | `socket.io-client@2.x`                     | `3.3.6`       |\n\n### Workarounds\n\nThere is no known workaround except upgrading to a safe version.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open a discussion [here](https://github.com/socketio/socket.io/discussions)","status":"published","published":"2026-08-03T19:09:44Z","modified":"2026-09-10T03:50:53.268104584Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-754"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"UBUNTU-CVE-2026-69185","description":"Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.","status":"published","published":"2026-08-03T20:17:00Z","modified":"2026-10-17T12:59:23.891215795Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:57.159276Z"},{"id":"CLSA-2026-1788863154","title":"TuxCare security update for socket.io-parser (1 CVE)","description":"TuxCare rebuilt socket.io-parser to address 1 CVE. Fixed in 3.2.0-tuxcare.3.","status":"published","published":"2026-09-08T10:25:54Z","modified":"2026-10-15T09:47:55.481718056Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1788863169","title":"TuxCare security update for socket.io-parser (1 CVE)","description":"TuxCare rebuilt socket.io-parser to address 1 CVE. Fixed in 3.1.3-tuxcare.2.","status":"published","published":"2026-09-08T10:26:09Z","modified":"2026-10-15T09:47:55.467270726Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1788863171","title":"TuxCare security update for socket.io-parser (1 CVE)","description":"TuxCare rebuilt socket.io-parser to address 1 CVE. Fixed in 3.3.4-tuxcare.2.","status":"published","published":"2026-09-08T10:26:11Z","modified":"2026-10-15T09:47:55.443834586Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1791899634","title":"TuxCare security update for socket.io-parser (5 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 5 CVEs. Fixed in 2.3.1-tuxcare.1.","status":"published","published":"2026-10-13T13:53:54Z","modified":"2026-10-15T09:47:53.469310802Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792599106","title":"TuxCare security update for socket.io-parser (5 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 5 CVEs. Fixed in 2.2.2-tuxcare.1.","status":"published","published":"2026-10-21T16:11:46Z","modified":"2026-10-21T20:30:50.501354765Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792665531","title":"TuxCare security update for socket.io-parser (5 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 5 CVEs. Fixed in 2.2.4-tuxcare.1.","status":"published","published":"2026-10-22T10:38:51Z","modified":"2026-10-22T14:15:04.657404145Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792666457","title":"TuxCare security update for socket.io-parser (2 CVEs)","description":"TuxCare rebuilt socket.io-parser to address 2 CVEs. Fixed in 4.0.5-tuxcare.1.","status":"published","published":"2026-10-22T10:54:17Z","modified":"2026-10-22T14:15:04.616703857Z","updated_at":"2026-11-02T15:43:54.981307Z"}]}}