Socketio vulnerabilities
We track 9 vulnerabilities in Socketio products across 3 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on October 13, 2026.
Latest Socketio vulnerabilities
- 7.5 High severity
socket.io: Uncaught Exception
Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored o
- 7.5 High severity
Socket.IO enables bidirectional and low-latency communication for every platform.
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such a
- 7.5 High severity
Socket.IO enables bidirectional and low-latency communication for every platform.
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited t
- 7.5 High severity
engine.io: Improper Resource Shutdown or Release
Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-s
- 7.5 High severity
Socket.IO enables bidirectional and low-latency communication for every platform.
Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object during
- 7.5 High severity
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework.
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, whic
- 7.3 High severity
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework.
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22
- 7.5 High severity
socket.io-parser: Improper Check for Unusual or Exceptional Conditions
socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch
- 7.5 High severity
engine.io: Improper Handling of Exceptional Conditions
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This i