Socket.IO Memory Exhaustion Vulnerability in Bidirectional Communication
CVE-2026-69185
7.5HIGH
What is CVE-2026-69185?
A memory exhaustion vulnerability exists in Socket.IO, affecting versions prior to 4.2.7, 3.4.5, and 3.3.6. This flaw allows an attacker to craft a malicious Socket.IO packet that forces the server to wait for an excessive number of binary attachments. Consequently, this can lead to memory consumption issues, potentially causing the server to exhaust its memory resources. Users of affected versions are strongly advised to update to the latest secure releases to mitigate this risk. Further details can be found in the security advisories provided by the Socket.IO team.
Affected Version(s)
socket.io < 3.3.6 < 3.3.6
socket.io >= 3.4.0, < 3.4.5 < 3.4.0, 3.4.5
socket.io >= 4.0.0, < 4.2.7 < 4.0.0, 4.2.7