EUVD-2026-42312
GHSA-gr94-w7qr-f4j3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, low-complexity crafted session ID, no auth or interaction, causing only a crash - availability-only A:H with C:N/I:N; the WebTransport prerequisite is a config condition, not a CVSS base metric.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object during WebTransport upgrade handling, causing a TypeError and denial of service. This issue is fixed in version 6.6.7.
AnalysisAI
Denial of service in Engine.IO 6.5.0 through 6.6.6 (the transport layer beneath Socket.IO) lets remote unauthenticated attackers crash the server by supplying a crafted session ID like '__proto__' during a WebTransport upgrade. Because the session ID is looked up against the internal clients object without guarding inherited properties, the resolved value is a prototype function rather than a client, triggering a TypeError that terminates request handling. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trigger is trivial to reproduce on any server that has WebTransport enabled.
Technical ContextAI
Engine.IO is the low-level transport abstraction (polling, WebSocket, and WebTransport) that Socket.IO builds on to provide bidirectional real-time messaging for Node.js applications. During a WebTransport session upgrade the server maps an incoming session ID to a connected client by indexing the internal clients dictionary; when the ID is a JavaScript inherited property name such as __proto__, constructor, or toString, the lookup returns an object from the prototype chain instead of undefined, and subsequent handling of that non-client value throws a TypeError. This is a CWE-20 improper input validation issue (a prototype-inheritance / unguarded object-key access pattern) rather than true prototype pollution, since the attacker reads an inherited property rather than writing one. The CPE cpe:2.3:a:socketio:socket.io covers the affected package family, but the defect and the fix live specifically in the engine.io component, patched in engine.io@6.6.7 via commit 1fa1f46cd420ac5b57bb4c04c959b58f3c79158c.
RemediationAI
Vendor-released patch: engine.io 6.6.7 - upgrade the engine.io dependency (directly or transitively via socket.io) to 6.6.7 or later, per the release at https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7 and advisory GHSA-gr94-w7qr-f4j3. If you cannot patch immediately, the most effective compensating control is to disable WebTransport in the Engine.IO server options so the vulnerable upgrade path is never reached; the trade-off is loss of the WebTransport transport, causing affected clients to fall back to WebSocket or HTTP long-polling with no functional loss for most deployments. As a secondary control, place a reverse proxy or WAF rule in front of the server to reject session IDs matching inherited-property names (e.g. __proto__, constructor, prototype, toString), accepting that this is fragile pattern-matching and should not substitute for the patch. The fix commit is 1fa1f46cd420ac5b57bb4c04c959b58f3c79158c.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today