CVE-2026-59724: Engine.IO Denial of Service Vulnerability via WebTransport SID
Summary
CVE-2026-59724: Socket.IO: Engine.IO WebTransport SID DoS. Affects engine.io versions >= 6.5.0, < 6.6.7. Fixed in 6.6.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Engine.IO is a widely used library that enables real-time communication between clients and servers, primarily used in conjunction with Socket.IO. It supports various transport protocols, including WebSocket and polling. The library is designed to facilitate efficient data exchange in web applications. However, certain configurations, particularly with WebTransport enabled, expose it to vulnerabilities that can be exploited by malicious actors.
Vulnerability Detail
The vulnerability arises from the improper handling of session IDs in Engine.IO when WebTransport is enabled. A malicious client can send a crafted upgrade request containing a specially chosen session ID, such as 'proto'. This leads to a session ID lookup that may resolve to an inherited prototype property instead of a valid Engine.IO client. The result is a TypeError during the WebTransport upgrade handling process. Since this failure occurs asynchronously, it can lead to unhandled Promise rejections, potentially crashing the Node.js process. This vulnerability allows unauthenticated attackers to cause denial of service, particularly in configurations where WebTransport support is enabled.
How To Fix
Latest published version: 6.6.11 as of 23 Oct 2026
npm install engine.io@6.6.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.6.7
This is the first release that contains the fix.
npm install engine.io@6.6.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, you can mitigate the issue by disabling WebTransport support. Ensure that 'webtransport' is not included in the enabled transports list. Here is an example of how to configure the server:
const engine = new Server({ transports: ['polling', 'websocket'], });
Additionally, consider restricting access to WebTransport endpoints at the reverse proxy or HTTP/3 layer.
Conclusion
In summary, CVE-2026-59724 is a critical vulnerability in Engine.IO that can lead to denial of service when WebTransport is enabled. Users are strongly advised to upgrade to the patched version or implement workarounds to mitigate the risk until an upgrade can be performed.
See every vulnerability recorded for engine.io →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
No, WebTransport is not enabled by default in Engine.IO. It is an opt-in feature.
Successful exploitation can lead to denial of service, causing the server process to crash and potentially enter crash loops under a process supervisor.
If upgrading is not possible, you can disable WebTransport support and restrict access to WebTransport endpoints as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for engine.io.
