GitHub Advisoryadvisory · npm

GHSA-677m-j7p3-52f9 socket.io allows an unbounded number of binary attachments

HIGH Published 2026-03-18 Modified 2026-03-20 Official page ↗
Aliases
CVE-2026-33151
Ecosystem
npm
Packages
socket.io-parser
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-754
Reviewed
2026-03-18

Affected packages

• npm socket.io-parser: < 3.3.5 → fixed in 3.3.5 • npm socket.io-parser: >= 3.4.0, < 3.4.4 → fixed in 3.4.4 • npm socket.io-parser: >= 4.0.0, < 4.2.6 → fixed in 4.2.6

Description

Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. Patches | Version range | Used by | Fixed version | |------------------|--------------------------------------------|---------------| | `>=4.0.0 =3.4.0 <3.4.4` | `[email protected]` | `3.4.4` | | `<3.3.5` | `[email protected]` | `3.3.5` | Workarounds There is no known workaround except upgrading to a safe version. For more information If you have any questions or comments about this advisory: • Open a discussion here

Related

Alias · CVE (1)

  • CVE-2026-33151 Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. vulnerability

Weakness · CWE (1)

  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness

References