Approved changes feed: RSS · Atom
cpe:2.3:a:socketio:socket.io:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Socketio (d25aed74-5ea0-592f-ac75-269cc3f6f7a6) |
|---|---|
| Product | Socket.Io (387e67da-7537-53f5-ad68-a6cbbb5f0be0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-59725 |
vulnerable | 2026-07-29 01:03:17.563165 |
Socket.IO: Engine.IO Polling Transport Connection Exhaustion
HIGH (7.5)
Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.
Published: 2026-07-08T15:37:52.293Z
Updated: 2026-07-08T17:00:32.946Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-59724 |
vulnerable | 2026-07-29 01:03:17.562977 |
Socket.IO: Engine.IO WebTransport SID DoS
HIGH (7.5)
Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object during WebTransport upgrade handling, causing a TypeError and denial of service. This issue is fixed in version 6.6.7.
Published: 2026-07-08T15:35:39.813Z
Updated: 2026-07-08T19:41:18.905Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33151 |
vulnerable | 2026-06-08 07:59:09.168580 |
socket.io allows an unbounded number of binary attachments
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.
Published: 2026-03-20T20:13:31.424Z
Updated: 2026-03-23T16:50:16.998Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-38355 |
vulnerable | 2026-06-08 06:41:45.120710 |
Unhandled 'error' event in socket.io
HIGH (7.3)
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.
Published: 2024-06-19T19:48:50.193Z
Updated: 2024-09-03T20:35:40.515Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.