socket.io-parser CVE-2026-69185

No special server configuration or feature flag is required. Any Socket.IO server using socket.io-parser 4.0.0-4.2.6 (socket.io@4.x), 3.4.0-3.4.4 (socket.io@2.x), or below 3.3.6 (socket.io-client@2.x) that accepts connections from untrusted network clients is exploitable. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default configurations with no complexity barrier. Exploitation is limited to availability impact only - confidentiality and integrity are unaffected. The primary limiting factor is network access: if the Socket.IO port is firewalled to trusted clients or internal networks only, remote exploitation is prevented. Rate-limiting at the load-balancer or reverse-proxy layer for WebSocket connection establishment may slow but not prevent a determined attacker with persistent connection access.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5, indicating a straightforward, unauthenticated, network-accessible denial-of-service with no complexity barrier. This assessment is consistent with the technical description - no credentials, configuration, or user interaction are needed. No EPSS score was supplied and KEV status is not confirmed, so exploitation probability cannot be quantified precisely. No public exploit code has been identified at time of analysis. Despite the absence of active exploitation evidence, the combination of zero authentication requirement, low attack complexity, and broad deployment of Socket.IO makes this a realistic operational risk for any publicly exposed Socket.IO endpoint. The input metadata tags this as 'Information Disclosure,' which is inconsistent with the actual vulnerability - the impact is purely availability (DoS); confidentiality and integrity are unaffected. Treat that tag as a data error when triaging.

An unauthenticated attacker opens a WebSocket connection to a public Socket.IO server running an affected version and floods it with binary-type protocol packets each declaring a large, non-zero attachment count. The server's Decoder enters a waiting state for each packet's attachments, allocating heap memory that is never freed. Sustained over seconds to minutes, this exhausts the Node.js process heap, causing the server to crash or become unresponsive to all clients.