CVE-2026-102599

Awaiting Analysis Awaiting Analysis - Queue

Socket.IO Engine.IO Heartbeat Parsing Remote DoS

Publication date: 2026-10-13

Last updated on: 2026-10-17

Assigner: GitHub, Inc.

Description

Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious client can establish a valid session and send an upgrade request with a different or omitted EIO query parameter, attaching a transport with incompatible parser and heartbeat behavior. A crafted heartbeat packet can then trigger an uncaught exception and terminate the Node.js process, including when Engine.IO v3 compatibility is disabled because an omitted EIO value is interpreted as revision 3 on the affected path. This issue is fixed in Engine.IO 6.6.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-17

Generated

2026-10-20

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-19

NVD

CVE-2026-102599

EUVD

EUVD-2026-100462

Affected Vendors & Products

Vendor	Product	Version / Range
socketio	socket.io	>= 6.6.0, < 6.6.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial-of-service issue in Socket.IO and Engine.IO servers. It occurs when a malicious client exploits transport upgrades by sending an upgrade request with a different or omitted EIO query parameter. This causes the server to use an inconsistent parser and heartbeat behavior, leading to an uncaught exception that terminates the Node.js process.

Detection Guidance

Monitor for unexpected Node.js process terminations in Socket.IO or Engine.IO servers. Check server logs for PROTOCOL_MISMATCH errors or uncaught exceptions during transport upgrades. Inspect network traffic for WebSocket upgrade requests with inconsistent EIO query parameters.

Impact Analysis

The vulnerability can cause your Socket.IO server to crash, resulting in downtime and loss of service for users. It affects availability by allowing attackers to terminate the server process remotely without authentication.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by crashing Node.js processes, which could disrupt services handling sensitive data. For GDPR, this may lead to temporary loss of availability of personal data processing systems, potentially violating Article 32 requirements for security and resilience. HIPAA-covered entities might face disruptions in systems managing protected health information, risking delays in access or processing.

Mitigation Strategies

Upgrade to Engine.IO version 6.6.10 or later. As temporary mitigations, disable transport upgrades or restrict to a single transport, though these may impact client compatibility.

Hi! I’m here to help you understand CVE-2026-102599. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70