Socket.IO CVE-2026-59725

Exploitation requires that the target run the Engine.IO protocol v4 HTTP long-polling transport (the default polling fallback in affected socket.io/engine.io versions 4.1.0-6.6.6) and accept client POST requests; the specific trigger is an invalid binary POST body sent with Content-Type: application/octet-stream, which the server fails to close. No authentication and no user interaction are needed (PR:N/UI:N). Limiting factors: deployments configured for WebSocket-only transport are not exposed via this path, and endpoints fronted by proxies/WAFs that constrain POST content-types or enforce per-IP connection limits raise the effort required; the impact is confined to availability, so no data is read or altered.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: network-reachable, low-complexity, unauthenticated, no user interaction, and impact limited purely to availability (C:N/I:N). This is a genuine resource-exhaustion DoS, not a data-exposure issue - note the input Tags label it 'Information Disclosure,' which conflicts with the description and the C:N/I:N vector and should be disregarded as a mislabel. No EPSS score, KEV entry, or POC was provided, so exploitation likelihood signals are absent; realistically the attack is trivial to script but yields only service disruption, so prioritization should track exposure of the polling endpoint rather than crown-jewel risk. Priority is high for internet-facing realtime services relying on HTTP long-polling, and lower where only the WebSocket transport is used or the endpoint sits behind rate-limiting/connection caps.

An attacker locates an internet-facing Socket.IO service that accepts the Engine.IO v4 HTTP polling transport and scripts a loop that repeatedly POSTs malformed binary bodies with Content-Type: application/octet-stream. Each request leaves an HTTP response and its socket open, so within minutes the server runs out of available connections and file descriptors and stops serving legitimate users. No authentication, user interaction, or POC is required - the low-complexity network vector makes this easy to automate.