Socket.IO Cluster Engine EUVD-2026-88981

Exploitation requires that the target application uses the @socket.io/cluster-engine package (versions prior to 0.1.1) in a clustered/multi-node deployment - applications using plain Socket.IO without cluster-engine are explicitly NOT affected. Given this configuration, an unauthenticated remote attacker simply needs network reachability to the Socket.IO endpoint and supplies a crafted session ID whose value collides with an inherited Object property name (e.g. __proto__ or constructor). No authentication, credentials, or user interaction are required (PR:N/UI:N), and default configurations of cluster-engine are vulnerable; the primary limiting factor is the deployment-specific dependency on cluster-engine rather than any special runtime setting.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, unauthenticated, low-complexity flaw with pure availability impact - no confidentiality or integrity loss. This is a classic prototype-chain lookup bug (attacker-controlled session IDs like __proto__ or constructor resolve to inherited Object.prototype members rather than a real client), causing an unhandled condition that crashes the Node.js process. The fix confirms the mechanism: a safeGet() helper gating all this.clients[sid] lookups behind Object.prototype.hasOwnProperty.call(). No EPSS score, KEV entry, or public POC was provided, so there is no evidence of active exploitation; the 7.5 reflects the ease and remoteness of triggering a crash, not code execution. This is a genuine, easily-triggerable DoS but a bounded one - a single-vector availability issue, not an RCE. The critical scoping caveat is that ONLY applications using @socket.io/cluster-engine in clustered deployments are affected; the vendor explicitly states non-cluster-engine users are not impacted, which sharply narrows the real-world exposure below what a bare '7.5 / Socket.IO' reading would imply.

An attacker connects to an internet-facing Socket.IO service that runs @socket.io/cluster-engine and supplies a session ID of __proto__ or constructor. The lookup resolves through the prototype chain to an inherited object instead of a real client, triggering an unhandled state that crashes the Node.js worker and denies service to all users. No authentication or user interaction is required; no public exploit code was identified at time of analysis, though the mechanism is trivial to reproduce from the advisory and commit diff.