Socket.io vulnerabilities
We track 2 vulnerabilities in Socket.io products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 29, 2026.
2vulnerabilities
1critical
1high
0exploited
8.7average CVSS score
Latest Socket.io vulnerabilities
- 7.5 High severity
Socket.IO enables bidirectional and low-latency communication for every platform.
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such a
- 9.8 Critical severity
Socket.io-Parser: Improper Neutralization of Special Elements used in an SQL Command
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.