CVE-2026-69185: Socket.IO Zero-Attachment Memory Exhaustion Vulnerability
Summary
CVE-2026-69185: Socket.IO: Zero-attachment Memory Exhaustion. Affects socket.io-parser across 3 version ranges.
< 3.3.6
>= 3.4.0, < 3.4.5
>= 4.0.0, < 4.2.7
Fixed in 3.3.6, 3.4.5 or 4.2.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Socket.IO is a widely used JavaScript library that enables real-time, bidirectional communication between web clients and servers. It is designed to facilitate the development of web applications that require real-time data exchange, such as chat applications, live notifications, and collaborative tools. The library supports various transport protocols and provides a robust API for managing connections and events. However, it is susceptible to a memory exhaustion vulnerability that can be exploited through specially crafted packets, leading to server instability.
Vulnerability Detail
The vulnerability arises from the way Socket.IO handles binary attachments in packets. An attacker can craft a malicious Socket.IO packet that prompts the server to wait for an excessive number of binary attachments. This can lead to the server consuming all available memory resources, resulting in a denial of service. The vulnerability is particularly concerning as it can be exploited without authentication, making it accessible to any user who can send packets to the server. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Latest published version: 4.2.7 as of 23 Oct 2026
npm install socket.io-parser@4.2.7The newest release already contains this fix.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.3.63.3.6npm install socket.io-parser@3.3.6 -
>= 3.4.0, < 3.4.53.4.5npm install socket.io-parser@3.4.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability other than upgrading to a safe version of the affected packages.
Conclusion
The CVE-2026-69185 vulnerability in Socket.IO poses a significant risk due to its potential for memory exhaustion attacks. It is essential to upgrade to the patched versions of the affected packages to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for socket.io-parser →
FAQ
CVE-2026-69185 is a vulnerability in Socket.IO that allows an attacker to exploit memory exhaustion by sending specially crafted packets.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
Exploitation of this vulnerability can lead to server crashes and denial of service, affecting the availability of your application.
Yes, it is crucial to upgrade all affected instances of Socket.IO to ensure that your application is secure against this vulnerability.
Vulert monitors and alerts for open-source vulnerabilities in your software using just package-lock.json, providing real-time insights without requiring code access.
References
Related vulnerabilities
Recent vulnerabilities recorded for socket.io-parser.
