EUVD-2026-42312
GHSA-gr94-w7qr-f4j3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WebTransport-enabled Engine.IO server
-
DeliveryInitiate WebTransport upgrade with session ID '__proto__'
-
ExploitServer resolves inherited property from clients object
-
ExecutionUnhandled TypeError thrown
-
ImpactServer request handling crashes (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | The Engine.IO server must have WebTransport enabled - this is the exact, non-default configuration prerequisite; servers using only polling or WebSocket transports are not exploitable. Given that condition, no authentication (PR:N), no user interaction (UI:N), and no special privileges are required, and the attacker only needs network reachability to the WebTransport upgrade endpoint on a server running engine.io 6.5.0 through 6.6.6. The primary limiting factor is therefore the WebTransport feature flag being turned on; the secondary limit is impact scope - the flaw yields only denial of service (A:H, C:N/I:N), not code execution or data disclosure. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields 7.5 (High) and is internally consistent: network-reachable, low-complexity, unauthenticated, availability-only impact with no confidentiality or integrity loss. No EPSS score was provided and the CVE is not in CISA KEV, so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis.' The one signal that tempers the raw score is the deployment prerequisite: exploitation only works when WebTransport is enabled, which is a relatively new and non-default transport, so real-world exposure is narrower than the AV:N/PR:N metrics alone imply. Weighing these signals, this is a legitimately actionable availability bug for the subset of deployments using WebTransport, but not an emergency for the majority of Socket.IO servers still on polling/WebSocket transports - verify whether WebTransport is enabled before prioritizing. |
| Exploit ScenarioDerived | An attacker points a WebTransport-capable client at an Internet-exposed Engine.IO server (6.5.0-6.6.6) that has WebTransport enabled and initiates an upgrade using a session ID of '__proto__'. The server indexes its clients object with that key, receives an inherited function instead of a client object, and throws an unhandled TypeError that disrupts request handling and denies service to legitimate users. No public POC is identified, but the crafted-ID trigger is trivial to construct given the low attack complexity (AC:L) and requires no authentication (PR:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 08, 2026
Denial of service in Engine.IO 6.5.0 through 6.6.6 (the transport layer beneath Socket.IO) lets remote unauthenticated attackers crash the server by supplying a crafted session ID like '__proto__' during a WebTransport upgrade. Because the session ID is looked up against the internal clients object without guarding inherited properties, the resolved value is a prototype function rather than a client, triggering a TypeError that terminates request handling. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trigger is trivial to reproduce on any server that has WebTransport enabled.
RemediationAI
Vendor-released patch: engine.io 6.6.7 - upgrade the engine.io dependency (directly or transitively via socket.io) to 6.6.7 or later, per the release at https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7 and advisory GHSA-gr94-w7qr-f4j3. If you cannot patch immediately, the most effective compensating control is to disable WebTransport in the Engine.IO server options so the vulnerable upgrade path is never reached; the trade-off is loss of the WebTransport transport, causing affected clients to fall back to WebSocket or HTTP long-polling with no functional loss for most deployments. As a secondary control, place a reverse proxy or WAF rule in front of the server to reject session IDs matching inherited-property names (e.g. __proto__, constructor, prototype, toString), accepting that this is fragile pattern-matching and should not substitute for the patch. The fix commit is 1fa1f46cd420ac5b57bb4c04c959b58f3c79158c.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Engine.IO is the low-level transport abstraction (polling, WebSocket, and WebTransport) that Socket.IO builds on to provide bidirectional real-time messaging for Node.js applications. During a WebTransport session upgrade the server maps an incoming session ID to a connected client by indexing the internal clients dictionary; when the ID is a JavaScript inherited property name such as __proto__, constructor, or toString, the lookup returns an object from the prototype chain instead of undefined, and subsequent handling of that non-client value throws a TypeError. This is a CWE-20 improper input validation issue (a prototype-inheritance / unguarded object-key access pattern) rather than true prototype pollution, since the attacker reads an inherited property rather than writing one. The CPE cpe:2.3:a:socketio:socket.io covers the affected package family, but the defect and the fix live specifically in the engine.io component, patched in engine.io@6.6.7 via commit 1fa1f46cd420ac5b57bb4c04c959b58f3c79158c.
Know when Socket Io gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, low-complexity crafted session ID, no auth or interaction, causing only a crash - availability-only A:H with C:N/I:N; the WebTransport prerequisite is a config condition, not a CVSS base metric.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object during WebTransport upgrade handling, causing a TypeError and denial of service. This issue is fixed in version 6.6.7.
Executive ViewAI
Engine.IO versions 6.5.0 to 6.6.6 are vulnerable to remote denial-of-service attacks that disable production services without authentication, affecting any organization using these versions of Socket.IO's transport layer. Real-time communication applications face immediate availability risk. The vulnerability is trivial to exploit, creating urgent operational impact.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable WebTransport if not operationally required; (2) Implement strict validation on session identifiers to reject reserved property names; (3) Deploy rate limiting on connection upgrade attempts; (4) Enable detailed logging of transport-layer errors to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Denial of service in Socket.IO (Engine.IO server) from 4.1.0 before 6.6.7 lets a remote unauthenticated attacker exhaust
Denial of service in Socket.IO Cluster Engine versions before 0.1.1 allows unauthenticated remote attackers to crash Nod
Exploit-DB