CVE-2026-69185
Received Received - Intake

Denial of Service in Socket.IO

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-04
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-69185
EUVD
EUVD-2026-52410

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
socketio socket.io to 4.2.7 (inc)
socketio socket.io to 3.4.5 (inc)
socketio socket.io to 3.3.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Socket.IO allows a specially crafted packet to make the server wait for and buffer a large number of binary attachments. This can exhaust the server's memory resources by forcing it to store excessive data in memory.

Detection Guidance

This vulnerability can be detected by checking the installed version of Socket.IO. If your system is running a version prior to 4.2.7, 3.4.5, or 3.3.6, it is vulnerable. Use commands like 'npm list socket.io' or 'npm list socket.io@3' to check the installed version.

Impact Analysis

This vulnerability can cause the server to run out of memory, leading to crashes or degraded performance. It may disrupt services relying on Socket.IO for real-time communication, causing downtime or data loss.

Compliance Impact

This vulnerability could lead to denial-of-service conditions by exhausting server memory, potentially disrupting services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Immediately upgrade Socket.IO to version 4.2.7, 3.4.5, or 3.3.6 or later to patch the vulnerability. Monitor server memory usage for unusual spikes that may indicate exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69185. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart