EUVD-2026-42313
GHSA-r635-g3xr-vw7x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, unauthenticated, low-complexity POST to the polling endpoint with no interaction; impact is pure resource-exhaustion DoS, so A:H and C:N/I:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.
AnalysisAI
Denial of service in Socket.IO (Engine.IO server) from 4.1.0 before 6.6.7 lets a remote unauthenticated attacker exhaust server-side connections and sockets by sending invalid binary POST requests. When the Engine.IO v4 polling transport receives a malformed binary payload with Content-Type: application/octet-stream, it fails to close the HTTP response, leaking the underlying socket until connection and file-descriptor limits are reached. No public exploit identified at time of analysis; the flaw is fixed in engine.io 6.6.7.
Technical ContextAI
Socket.IO is a widely used JavaScript library for bidirectional, low-latency realtime messaging between clients and servers, layered on top of the Engine.IO transport abstraction. Engine.IO supports both WebSocket and HTTP long-polling transports; when using the v4 polling transport, clients POST payloads to the server. The bug is a CWE-404 (Improper Resource Shutdown or Release): the server-side POST handler does not terminate/close the HTTP response object when it receives an invalid binary body under Content-Type: application/octet-stream. Because the response is never ended, the associated TCP socket and connection slot remain allocated, and repeated requests steadily consume the server's finite pool of sockets and file descriptors. The affected component is the Node.js engine.io server package (CPE cpe:2.3:a:socketio:socket.io); the fix is delivered as the engine.io@6.6.7 release rather than a socket.io top-level tag.
RemediationAI
Vendor-released patch: engine.io 6.6.7 - upgrade the engine.io dependency (directly or transitively via socket.io) to 6.6.7 or later, per release https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7 and advisory GHSA-r635-g3xr-vw7x. Because engine.io is often a transitive dependency of socket.io, verify the resolved version in your lockfile after upgrading. Where immediate patching is not possible, compensating controls include disabling the HTTP long-polling transport and forcing WebSocket-only on the server (transports: ['websocket']), which removes the vulnerable POST path but breaks clients on networks that cannot use WebSocket; placing the endpoint behind a reverse proxy or WAF that rejects or size-limits POSTs with Content-Type: application/octet-stream and enforces per-IP connection/rate limits; and lowering server socket timeouts / maxHttpBufferSize and setting OS-level file-descriptor and connection caps so leaked sockets are reclaimed faster, at the cost of possibly dropping some legitimate slow clients.
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today