GitHub Advisoryadvisory · npm

GHSA-2m8v-j782-fhvr Socket.IO: Zero-attachment Memory Exhaustion

HIGH Published 2026-08-03 Modified 2026-08-03 Official page ↗
Aliases
CVE-2026-69185
Ecosystem
npm
Packages
socket.io-parser
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20, CWE-754
Reviewed
2026-08-03

Affected packages

• npm socket.io-parser: >= 4.0.0, < 4.2.7 → fixed in 4.2.7 • npm socket.io-parser: >= 3.4.0, < 3.4.5 → fixed in 3.4.5 • npm socket.io-parser: < 3.3.6 → fixed in 3.3.6

Description

Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. Patches | Version range | Used by | Fixed version | |------------------|--------------------------------------------|---------------| | `>=4.0.0 =3.4.0 <3.4.5` | `[email protected]` | `3.4.5` | | `<3.3.6` | `[email protected]` | `3.3.6` | Workarounds There is no known workaround except upgrading to a safe version. For more information If you have any questions or comments about this advisory: • Open a discussion here

Related

Alias · CVE (1)

  • CVE-2026-69185 Socket.IO enables bidirectional and low-latency communication for every platform. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness

References