CVE-2026-69185CWE-20CWE-754

CVE-2026-69185

High · published August 4, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
49.5
In the wild
Unconfirmed
What it is

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00630 · 49.5th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2026-08-04T00:17Z
References (4)
https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4 · [email protected]https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240 · [email protected]https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291 · [email protected]https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr · [email protected]
EPSS history
Timeline
  • 03 AUG 19:09Z
    Socket.IO: Zero-attachment Memory Exhaustion
    cvelistv5