Skip to main content

socket.io-parser EUVDEUVD-2026-52410

| CVE-2026-69185 HIGH
Improper Input Validation (CWE-20)
2026-08-03 https://github.com/socketio/socket.io GHSA-2m8v-j782-fhvr
Information Disclosure
7.5
CVSS 3.1 · Vendor: https://github.com/socketio/socket.io
Share

Severity by source

Vendor (https://github.com/socketio/socket.io) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Network-reachable with no authentication or complexity barrier; impact is availability-only with no confidentiality or integrity consequence, consistent with a remote DoS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (https://github.com/socketio/socket.io).

CVSS VectorVendor: https://github.com/socketio/socket.io

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 03, 2026 - 19:36 vuln.today
Analysis Generated
Aug 03, 2026 - 19:36 vuln.today
CVE Published
Aug 03, 2026 - 19:09 github-advisory
HIGH 7.5

DescriptionCVE.org

Impact

A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.

Patches

Version rangeUsed byFixed version
>=4.0.0 <4.2.7socket.io@4.x and socket.io-client@4.x4.2.7
>=3.4.0 <3.4.5socket.io@2.x3.4.5
<3.3.6socket.io-client@2.x3.3.6

Workarounds

There is no known workaround except upgrading to a safe version.

For more information

If you have any questions or comments about this advisory:

  • Open a discussion here

AnalysisAI

Memory exhaustion via malformed binary attachment packets in the socket.io-parser npm library allows unauthenticated remote attackers to crash or hang Socket.IO servers. By sending crafted packets that declare a large number of pending binary attachments, an attacker causes the server's Decoder to allocate and hold buffers indefinitely, exhausting Node.js heap memory. The vendor advisory (GHSA-2m8v-j782-fhvr) confirms the impact and vendor-released fixed versions are available; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Socket.IO's binary message protocol, implemented by the socket.io-parser library (pkg:npm/socket.io-parser), uses a multi-packet model: a primary packet declares a count of binary blob attachments expected to follow, and the Decoder buffers them until all arrive before emitting the reconstructed message. CWE-20 (Improper Input Validation) is the root cause: the parser failed to enforce a lower bound of 1 on declared attachment counts, permitting zero-attachment binary packets to enter the buffering state without resolution, and did not cap or validate large attachment counts against resource limits. The commit diff at 7c6ef571 shows two specific code changes: removal of the zero-attachment early-emit path that previously bypassed proper validation, and tightening the attachment count check from n < 0 to n < 1. A sustained stream of such packets causes unbounded heap growth in the Node.js process.

RemediationAI

Upgrade socket.io-parser to a fixed version: 4.2.7 for socket.io@4.x and socket.io-client@4.x users, 3.4.5 for socket.io@2.x users, or 3.3.6 for socket.io-client@2.x users. Because socket.io-parser is typically a transitive dependency, running npm update socket.io or npm update socket.io-client to the latest respective major-version release will pull in the patched parser. Patch commits are available at https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4 and https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240. The vendor advisory explicitly states there is no workaround other than upgrading. As a temporary compensating control while upgrading, restrict Socket.IO port access via firewall or reverse-proxy ACLs to trusted IP ranges only - this reduces exposure but breaks legitimate use cases for public-facing services and should not substitute for patching.

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

EUVD-2026-52410 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy