Socketio vulnerabilities

Products

• Socket.io 7
• Engine.io 4
• Socket.io-parser 2

Newest

• socketio socket.io Socket.IO: Engine.IO Protocol Revision Mismatch DoS CVE-2026-102599 Fix available 7.5 HighSeptember 29, 2026
• @socket.io cluster-engine, socketio socket.io +1 more Socket.IO: Prototype Pollution via Unsafe Client Session Lookup CVE-2026-102600 Fix available 7.5 HighSeptember 29, 2026
• socketio socket.io Socket.IO: Zero-attachment Memory Exhaustion CVE-2026-69185 Fix available 7.5 HighAugust 3, 2026
• socket engine.io Socket.IO: Engine.IO Polling Transport Connection Exhaustion CVE-2026-59725 Fix available 7.5 HighJuly 8, 2026
• socket engine.io, socketio socket.io +1 more Socket.IO: Engine.IO WebTransport SID DoS CVE-2026-59724 Fix available 7.5 HighJune 18, 2026
• socketio socket.io, socket socket.io-parser +1 more socket.io allows an unbounded number of binary attachments CVE-2026-33151 Fix available 8.7 HighMarch 18, 2026
• socket socket.io Unhandled 'error' event in socket.io CVE-2024-38355 Public exploitFix available 7.3 HighJune 19, 2024
• socket socket.io-parser Insufficient validation when decoding a Socket.IO packet CVE-2023-32695 Fix available 7.3 HighMay 23, 2023
• socket engine.io Uncaught exception in engine.io CVE-2023-31125 Fix available 6.5 MediumMay 3, 2023
• socket engine.io Uncaught exception in engine.io CVE-2022-41940 Fix available 7.1 HighNovember 21, 2022
• socket socket.io-parser Socket.io - Improper type validation in attachment parsing CVE-2022-2421 Fix available 10.0 CriticalOctober 25, 2022
• socket engine.io Uncaught Exception in engine.io CVE-2022-21676 Fix available 7.5 HighJanuary 12, 2022
• socket socket.io Insecure Defaults CVE-2020-28481 Fix available 5.3 MediumJanuary 19, 2021